,,ib ,union ,cal5d> ,no4 #gij #aah? ,,congress #b;d ,session ,h4 ,r4 #deeb ,report ,no4 #aah-ici1 ,"p ,i ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,july #aa1 #bjbc,ms4 ,mace 7= h]self1 ,mr4 ,rask91 ,mr4 ,com]1 & ,mr4 ,connolly7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,ov]sight & ,acc\ntability1 & 9 addition to ! ,committees on ,sci5ce1 ,space1 & ,te*nology1 ,homel& ,security1 & ,arm$ ,s]vices1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,decemb] #ai1 #bjbd;,additional sponsor3 ,mr4 ,davis ( ,nor? ,c>ol9a ,decemb] #ai1 #bjbd,report$ f ! ,committee on ,ov]sight & ,acc\ntability ) an amendment,strike out all aft] ! enact+ clause & ins]t ! "p pr9t$ 9 italic ,decemb] #ai1 #bjbd ,committees on ,sci5ce1 ,space1 & ,te*nology1 ,homel& ,security1 & ,arm$ ,s]vices dis*>g$2 committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union & ord]$ to be printed,for text ( introduc$ bill1 see copy ( bill z introduc$ on ,july #aa1 #bjbc ,a ,,bill ,to improve ! cyb]security ( ! ,f$]al ,gov]nm5t1 & = o!r purposes4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbd4 7b7 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4,sec4 #b4 ,def9itions4,sec4 #c4 ,am5dm5ts to title #dd4,sec4 #d4 ,am5dm5ts to subtitle ,,iii ( title #dj4,sec4 #e4 ,actions to enhance ,f$]al incid5t transp>5cy4,sec4 #f4 ,ag5cy requirem5ts to notify private sector entities impact$ by incid5ts4,sec4 #g4 ,f$]al p5etration te/+ policy4,sec4 #h4 ,vuln]ability disclosure policies4,sec4 #i4 ,implem5t+ z]o tru/ ar*itecture4,sec4 #aj4 ,automation & artificial intellig5ce4,sec4 #aa4 ,f$]al cyb]security requirem5ts4,sec4 #ab4 ,f$]al ,*ief ,in=mation ,security ,(fic]4,sec4 #ac4 ,r5am+ ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic]4,sec4 #ad4 ,rules ( con/ruction4 #b4 ,def9itions ,9 ?is ,act1 unless o!rwise specifi$3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#b7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,b7 ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives2 & 7,c7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives4 7#c7 ,aw>dee ,! t]m aw>dee has ! mean+ giv5 ! t]m 9 section #ceia ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7#d7 ,contractor ,! t]m contractor has ! mean+ giv5 ! t]m 9 section #ceia ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7#e7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#f7 ,f$]al in=mation sy/em ,! t]m ,f$]al in=mation sy/em has ! mean+ giv5 ! t]m 9 section #ceia ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7#g7 ,incid5t ,! t]m incid5t has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7#h7 ,national security sy/em ,! t]m national security sy/em has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7#i7 ,p5etration te/ ,! t]m p5etration te/ has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act4 7#aj7 ,?reat hunt+ ,! t]m ?reat hunt+ means proactively & it]atively se>*+ sy/ems = ?reats & vuln]abilities1 includ+ ?reats or vuln]abilities t may evade detection by automat$ ?reat detection sy/ems4 7#aa7 ,z]o tru/ ar*itecture ,! t]m z]o tru/ ar*itecture has ! mean+ giv5 ! t]m 9 ,special ,publication #hjj-bjg ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 or any successor docum5t4 #c4 ,am5dm5ts to title #dd 7a7 ,sub*apt] ,i am5dm5ts ,sub*apt] ,i ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #cejd-- 7,a7 9 subsection 7a77#a77;,b7-- 7i7 by /rik+ clause 7v7 & ins]t+ ! foll[+3 7v7 privacy1 confid5tiality1 disclosure1 & %>+ ( in=mation2 2 7ii7 by r$esignat+ clause 7vi7 z clause 7vii72 & 7iii7 by ins]t+ aft] clause 7v7 ! foll[+3 7vi7 9 consultation ) ! ,national ,cyb] ,director1 security ( in=mation2 & 2 & 7,b7 9 subsection 7g7-- 7i7 by r$esignat+ p>agraph 7#b7 z p>agraph 7#c72 & 7ii7 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 develop & ov]see ! implem5tation ( policies1 pr9ciples1 /&>ds1 & guidel9es on privacy1 confid5tiality1 disclosure1 & %>+ ( in=mation collect$ or ma9ta9$ by or = ag5cies2 7#b7 9 consultation ) ! ,national ,cyb] ,director1 ov]see ! implem5tation ( policies1 pr9ciples1 /&>ds1 & guidel9es on security1 ( in=mation collect$ or ma9ta9$ by or = ag5cies2 & 2 7#b7 9 section #ceje-- 7,a7 by /rik+ ! fir/ subsection designat$ z subsection 7c72 7,b7 9 p>agraph 7#b7 ( ! second subsection designat$ z subsection 7c71 by ins]t+ an id5tification ( int]net accessible in=mation sy/ems & aft] an inv5tory "u ?is subsection %all include2 7,c7 9 p>agraph 7#c7 ( ! second subsection designat$ z subsection 7c7-- 7i7 9 subp>agraph 7,b7-- 7,i7 by ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 & be=e ! ,comptroll] ,g5]al2 & 7,,ii7 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,c77v71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,d7 ma9ta9$ on a cont9ual basis ?r\gh ! use ( automation1 ma*9e-readable data1 & scann+1 :]ev] practicable4 2 7#c7 9 section #cejf-- 7,a7 9 subsection 7a77#c71 by ins]t+ ,9 c>ry+ out ^! duties1 ! ,*ief ,in=mation ,(fic] %all consult1 z appropriate1 ) ! ,*ief ,data ,(fic] 9 accordance ) ! designat$ functions "u section #cebj7;c74 aft] r$uction ( in=mation collection burd5s on ! public42 7,b7 9 subsection 7b77#a77;,c71 by ins]t+ availability1 aft] integrity12 7,c7 9 subsection 7h77#c71 by ins]t+ security1 aft] effici5cy12 & 7,d7 by add+ at ! end ! foll[+3 7j7 7#a7 ,not)/&+ p>agraphs 7#b7 & 7#c7 ( subsection 7a71 ! head ( ea* ag5cy %all1 9 accordance ) section #ebb7;a7 ( division ,h ( ! ,consolidat$ ,appropriations ,act1 #bjje 7#db ,u4,s4,c4 #bjjj;ee-#b71 designate a ,*ief ,privacy ,(fic] ) ! necess>y skills1 k1 & exp]tise1 :o %all h ! au?ority & responsibility to-- 7,a7 lead ! privacy program ( ! ag5cy2 & 7,b7 c>ry out ! privacy responsibilities ( ! ag5cy "u ?is *apt]1 section #eeb;a ( title #e1 & guidance issu$ by ! ,director4 7#b7 ,! ,*ief ,privacy ,(fic] ( ea* ag5cy %all-- 7,a7 s]ve 9 a c5tral lead]%ip position )9 ! ag5cy2 7,b7 h visibility into relevant ag5cy op]ations2 & 7,c7 be position$ highly en\gh )9 ! ag5cy to regul>ly engage ) o!r ag5cy lead]s & (ficials1 includ+ ! head ( ! ag5cy4 7#c7 ,a privacy (fic] ( an ag5cy e/abli%$ "u a /atute enact$ be=e ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbd may c>ry out ! responsibilities "u ?is subsection = ! ag5cy4 2 & 7#d7 9 section #ceac-- 7,a7 by r$esignat+ subsection 7c7 z subsection 7d72 & 7,b7 by ins]t+ aft] subsection 7b7 ! foll[+3 7c7 ,ea* ag5cy provid+ a writt5 plan "u subsection 7b7 %all provide any portion ( ! writt5 plan address+ in=mation security to ! ,secret>y ( ,homel& ,security & ! ,national ,cyb] ,director4 4 7b7 ,sub*apt] ,,ii def9itions 7#a7 ,9 g5]al ,section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 by r$esignat+ p>agraphs 7#b71 7#c71 7#d71 7#e71 7#f71 & 7#g7 z p>agraphs 7#c71 7#d71 7#e71 7#f71 7#h71 & 7#aj71 respectively2 7,b7 by ins]t+ aft] p>agraph 7#a7 ! foll[+3 7#b7 ,! t]m high value asset means in=mation or an in=mation sy/em t ! head ( an ag5cy1 us+ policies1 pr9ciples1 /&>ds1 or guidel9es issu$ by ! ,director "u section #ceec7;a71 det]m9es to be s critical to ! ag5cy t ! loss or degradation ( ! confid5tiality1 integrity1 or availability ( su* in=mation or in=mation sy/em w\ld h a s]i\s impact on ! ability ( ! ag5cy to p]=m ! mission ( ! ag5cy or conduct bus9ess4 2 7,c7 by ins]t+ aft] p>agraph 7#f71 z s r$esignat$1 ! foll[+3 7#g7 ,! t]m major incid5t has ! mean+ giv5 ! t]m 9 guidance issu$ by ! ,director "u section #ceih7;a74 2 7,d7 9 p>agraph 7#h77;,a71 z s r$esignat$1 9 ! matt] prec$+ clause 7i71 by /rik+ us$ & ins]t+ own$1 manag$12 7,e7 by ins]t+ aft] p>agraph 7#h71 z s r$esignat$1 ! foll[+3 7#i7 ,! t]m p5etration te/-- 7,a7 means an au?oriz$ assessm5t t emulates attempts to ga9 unau?oriz$ access to1 or disrupt ! op]ations (1 an in=mation sy/em or compon5t ( an in=mation sy/em2 & 7,b7 includes any additional mean+ giv5 ! t]m 9 policies1 pr9ciples1 /&>ds1 or guidel9es issu$ by ! ,director "u section #ceec7;a74 2 & 7,f7 by ins]t+ aft] p>agraph 7#aj71 z s r$esignat$1 ! foll[+3 7#aa7 ,! t]m %>$ s]vice means a c5traliz$ mission capability or consolidat$ bus9ess function t is provid$ to multiple organizations )9 an ag5cy or to multiple ag5cies4 7#ab7 ,! t]m z]o tru/ ar*itecture has ! mean+ giv5 ! t]m 9 ,special ,publication #hjj-bjg ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 or any successor docum5t4 4 7#b7 ,con=m+ am5dm5ts 7,a7 ,homel& ,security ,act ( #bjjb ,section #ajja7;c77#a77;,a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #eaa7;c77#a77;,a77 is am5d$ by /rik+ section #ceeb7;b77#e7 & ins]t+ section #ceeb7;b74 7,b7 ,title #aj 7i7 ,section #bbbb ,section #bbbb7;i77#h7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f77;,a7 & ins]t+ section #ceeb7;b77#h77;,a74 7ii7 ,section #bbbc ,section #bbbc7;c77#c7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7iii7 ,section #cjfh ,section #cjfh7;b7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7iv7 ,section #cbeb ,section #cbeb7;e77#e7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7,c7 ,high-,p]=mance ,comput+ ,act ( #aiia ,section #bjg7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebg7;a77 is am5d$ by /rik+ section #ceeb7;b77#f77;,a77i7 & ins]t+ section #ceeb7;b77#h77;,a77i74 7,d7 ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj ,section #c7e7 ( ! ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a7#e77 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7,e7 ,national ,def5se ,au?orization ,act = fiscal ,ye> #bjac ,section #icc7;e77#a77;,b7 ( ! ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjac 7#aj ,u4,s4,c4 #bbbd note7 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,f7 ,ike ,skelton ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjaa ,! ,ike ,skelton ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjaa 7,public ,law #aaa-chc7 is am5d$-- 7i7 9 section #ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b72 & 7ii7 9 section #icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,g7 ,e-,gov]nm5t ,act ( #bjjb ,section #cja7;c77#a77;,a7 ( ! ,e-,gov]nm5t ,act ( #bjjb 7#dd ,u4,s4,c4 #ceja note7 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,h7 ,national ,in/itute ( ,/&>ds & ,te*nology ,act ,section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is am5d$-- 7i7 9 subsection 7a77#b71 by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b72 & 7ii7 9 subsection 7f7-- 7,i7 9 p>agraph 7#b71 by /rik+ section #cecb7a7 & ins]t+ section #ceeb7;b72 & 7,,ii7 9 p>agraph 7#e71 by /rik+ section #cecb7;b77#b7 & ins]t+ section #ceeb7;b74 7c7 ,sub*apt] ,,ii am5dm5ts ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #ceea-- 7,a7 9 p>agraph 7#d71 by /rik+ diagnose & improve & ins]t+ integrate1 deliv]1 diagnose1 & improve2 7,b7 9 p>agraph 7#e71 by /rik+ & at ! end2 7,c7 9 p>agraph 7#f71 by /rik+ ! p]iod at ! end & ins]t+ a semicolon2 & 7,d7 by add+ at ! end ! foll[+3 7#g7 recognize t ea* ag5cy has specific mission requirem5ts &1 at times1 unique cyb]security requirem5ts to meet ! mission ( ! ag5cy2 7#h7 recognize t ea* ag5cy does n h ! same res\rces to secure ag5cy sy/ems1 & an ag5cy %\ld n be expect$ to h ! capability to secure ! sy/ems ( ! ag5cy f advanc$ adv]s>ies alone2 & 7#i7 recognize t a holi/ic ,f$]al cyb]security model is necess>y to acc\nt = diff]5ces betwe5 ! missions & capabilities ( ag5cies4 2 7#b7 9 section #ceec-- 7,a7 9 subsection 7a7-- 7i7 9 p>agraph 7#e71 by /rik+ & at ! end2 7ii7 9 p>agraph 7#f71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7#g7 promot+1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 & ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology-- 7,a7 ! use ( automation to improve ,f$]al cyb]security & visibility ) respect to ! implem5tation ( ,f$]al cyb]security2 & 7,b7 ! use ( presumption ( compromise & lea/ privilege pr9ciples1 su* z z]o tru/ ar*itecture1 to improve resili5cy & timely response actions to incid5ts on ,f$]al sy/ems4 2 7,b7 9 subsection 7b7-- 7i7 9 ! matt] prec$+ p>agraph 7#a71 by ins]t+ & ! ,national ,cyb] ,director aft] ,director2 7ii7 9 p>agraph 7#b77;,a71 by ins]t+ & report+ requirem5ts "u sub*apt] ,,iv ( ?is *apt] aft] section #ceef2 7iii7 by r$esignat+ p>agraphs 7#h7 & 7#i7 z p>agraphs 7#aj7 & 7#aa71 respectively2 & 7iv7 by ins]t+ aft] p>agraph 7#g7 ! foll[+3 7#h7 exp$iti\sly seek+ opportunities to r$uce co/s1 adm9i/rative burd5s1 & o!r b>ri]s to in=mation te*nology security & mod]nization = ag5cies1 includ+ ?r\gh %>$ s]vices 7& appropriate comm]cial (f ! %elf options = su* %>$ s]vices7 = cyb]security capabilities id5tifi$ z appropriate by ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & o!r ag5cies z appropriate2 2 7,c7 9 subsection 7c7-- 7i7 9 ! matt] prec$+ p>agraph 7#a7-- 7,i7 by /rik+ ea* ye> & ins]t+ ea* ye> dur+ :i* ag5cies are requir$ to submit reports "u section #ceed7;c72 7,,ii7 by ins]t+ 1 :i* %all be unclassifi$ b may include #a or m annexes t conta9 classifi$ or o!r s5sitive in=mation1 z appropriate aft] a report2 & 7,,iii7 by /rik+ prec$+ ye> & ins]t+ prec$+ #b ye>s2 7ii7 by /rik+ p>agraph 7#a72 7iii7 by r$esignat+ p>agraphs 7#b71 7#c71 & 7#d7 z p>agraphs 7#a71 7#b71 & 7#c71 respectively2 7iv7 9 p>agraph 7#c71 z s r$esignat$1 by /rik+ & at ! end2 & 7v7 by ins]t+ aft] p>agraph 7#c71 z s r$esignat$1 ! foll[+3 7#d7 a summ>y ( ! risks & tr5ds id5tifi$ 9 ! ,f$]al risk assessm5t requir$ "u subsection 7i72 & 2 7,d7 9 subsection 7h7-- 7i7 9 p>agraph 7#b7-- 7,i7 9 subp>agraph 7,a71 by ins]t+ & ! ,national ,cyb] ,director aft] 9 coord9ation ) ! ,director2 7,,ii7 9 subp>agraph 7,b71 by ins]t+ 1 ! scope ( ! requir$ action 7su* z applicable s(tw>e1 firmw>e1 or h>dw>e v]sions71 aft] reasons = ! requir$ action2 & 7,,iii7 9 subp>agraph 7,d71 by ins]t+ 1 ! ,national ,cyb] ,director1 aft] notify ! ,director2 & 7ii7 9 p>agraph 7#c77;,a77iv71 by ins]t+ 1 ! ,national ,cyb] ,director aft] ! ,secret>y provides prior notice to ! ,director2 7,e7 by am5d+ subsection 7i7 to read z foll[s3 7i7 ,f$]al risk assessm5t ,on an ongo+ & cont9ual basis1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all assess ! ,f$]al risk po/ure us+ any available in=mation on ! cyb]security po/ure ( ag5cies1 & brief ! ,director & ,national ,cyb] ,director on ! f9d+s ( su* assessm5t1 includ+-- 7#a7 ! /atus ( ag5cy cyb]security rem$ial actions = high value assets describ$ 9 section #ceed7;b77#g72 7#b7 any vuln]ability in=mation relat+ to ! sy/ems ( an ag5cy t is kn[n by ! ag5cy2 7#c7 analysis ( incid5t in=mation "u section #ceig2 7#d7 evaluation ( p5etration te/+ p]=m$ "u section #ceei;,a2 7#e7 evaluation ( vuln]ability disclosure program in=mation "u section #ceei;,b2 7#f7 evaluation ( ag5cy ?reat hunt+ results2 7#g7 evaluation ( ,f$]al & non-,f$]al cyb] ?reat intellig5ce2 7#h7 data on ag5cy compliance ) /&>ds issu$ "u section #aacca ( title #dj2 7#i7 ag5cy sy/em risk assessm5ts requir$ "u section #ceed7;a77#a77;,a72 7#aj7 relevant reports f inspectors g5]al ( ag5cies & ! ,gov]nm5t ,acc\ntability ,(fice2 & 7#aa7 any o!r in=mation ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy det]m9es relevant4 2 & 7,f7 by add+ at ! end ! foll[+3 7m7 ,directives 7#a7 ,em]g5cy directive updates ,if ! ,secret>y issues an em]g5cy directive "u ?is section1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! ,director1 ! ,national ,cyb] ,director1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 & ! ,committees on ,ov]sight & ,acc\ntability & ,homel& ,security ( ! ,h\se ( ,repres5tatives an update on ! /atus ( ! implem5tation ( ! em]g5cy directive at ag5cies n lat] ?an #g days aft] ! date on :i* ! em]g5cy directive requires an ag5cy to complete a requirem5t specifi$ by ! em]g5cy directive1 & e #cj days !reaft] until-- 7,a7 ! date on :i* e ag5cy has fully implem5t$ ! em]g5cy directive2 7,b7 ! ,secret>y det]m9es t an em]g5cy directive no long] requires active report+ f ag5cies or additional implem5tation2 or 7,c7 ! date t is #a ye> aft] ! issuance ( ! directive4 7#b7 ,b9d+ op]ational directive updates ,if ! ,secret>y issues a b9d+ op]ational directive "u ?is section1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! ,director1 ! ,national ,cyb] ,director1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 & ! ,committees on ,ov]sight & ,acc\ntability & ,homel& ,security ( ! ,h\se ( ,repres5tatives an update on ! /atus ( ! implem5tation ( ! b9d+ op]ational directive at ag5cies n lat] ?an #cj days aft] ! issuance ( ! b9d+ op]ational directive1 & e #ij days !reaft] until-- 7,a7 ! date on :i* e ag5cy has fully implem5t$ ! b9d+ op]ational directive2 7,b7 ! ,secret>y det]m9es t a b9d+ op]ational directive no long] requires active report+ f ag5cies or additional implem5tation2 or 7,c7 ! date t is #a ye> aft] ! issuance or sub/antive update ( ! directive4 7#c7 ,report ,if ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy ceases submitt+ updates requir$ "u p>agraphs 7#a7 or 7#b7 on ! date describ$ 9 p>agraph 7#a77;,c7 or 7#b77;,c71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! ,director1 ! ,national ,cyb] ,director1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 & ! ,committees on ,ov]sight & ,acc\ntability & ,homel& ,security ( ! ,h\se ( ,repres5tatives a li/ ( e ag5cy t1 at ! "t ( ! report-- 7,a7 has n complet$ a requirem5t specifi$ by an em]g5cy directive2 or 7,b7 has n implem5t$ a b9d+ op]ational directive4 7n7 ,review ( ,(fice ( ,managem5t & ,budget guidance & policy 7#a7 ,conduct ( review ,n less frequ5tly ?an once e #c ye>s1 ! ,director ( ! ,(fice ( ,managem5t & ,budget %all review ! efficacy ( ! guidance & policy promulgat$ by ! ,director 9 r$uc+ cyb]security risks1 includ+ a consid]ation ( report+ & compliance burd5 on ag5cies4 7#b7 ,congressional notification ,! ,director ( ! ,(fice ( ,managem5t & ,budget %all notify ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives ( ! results ( ! review "u p>agraph 7#a74 7#c7 ,,gao review ,! ,gov]nm5t ,acc\ntability ,(fice %all review guidance & policy promulgat$ by ! ,director to assess its efficacy 9 risk r$uction & burd5 on ag5cies4 7o7 ,automat$ /&>d implem5tation v]ification ,:5 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology issues a propos$ /&>d or guidel9e pursuant to p>agraphs 7#b7 or 7#c7 ( section #bj7;a7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a771 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all consid] develop+ &1 if appropriate & practical1 develop specifications to enable ! automat$ v]ification ( ! implem5tation ( ! controls4 7p7 ,inspectors g5]al access to f$]al risk assessm5ts ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all1 ^u reque/1 make available ,f$]al risk assessm5t in=mation "u subsection 7i7 to ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,homel& ,security & ! inspector g5]al ( any ag5cy t 0 includ$ 9 ! ,f$]al risk assessm5t4 2 7#c7 9 section #ceed-- 7,a7 9 subsection 7a7-- 7i7 9 p>agraph 7#a7-- 7,i7 by r$esignat+ subp>agraphs 7,a71 7,b71 & 7,c7 z subp>agraphs 7,b71 7,c71 & 7,d71 respectively2 7,,ii7 by ins]t+ be=e subp>agraph 7,b71 z s r$esignat$1 ! foll[+3 7,a7 on an ongo+ & cont9ual basis1 assess+ ag5cy sy/em risk1 z applicable1 by-- 7i7 id5tify+ & docum5t+ ! high value assets ( ! ag5cy us+ guidance f ! ,director2 7ii7 evaluat+ ! data assets inv5tori$ "u section #ceaa = s5sitivity to compromises 9 confid5tiality1 integrity1 & availability2 7iii7 id5tify+ :e!r ! ag5cy is p>ticipat+ 9 f$]ally (f]$ cyb]security %>$ s]vices programs2 7iv7 id5tify+ ag5cy sy/ems t h access to or hold ! data assets inv5tori$ "u section #ceaa2 7v7 evaluat+ ! ?reats fac+ ag5cy sy/ems & data1 includ+ high value assets1 bas$ on ,f$]al & non-,f$]al cyb] ?reat intellig5ce products1 :]e available2 7vi7 evaluat+ ! vuln]ability ( ag5cy sy/ems & data1 includ+ high value assets1 includ+ by analyz+-- 7,i7 ! results ( p5etration te/+ p]=m$ by ! ,dep>tm5t ( ,homel& ,security "u section #ceec7;b77#i72 7,,ii7 ! results ( p5etration te/+ p]=m$ "u section #ceei;,a2 7,,iii7 in=mation provid$ to ! ag5cy ?r\gh ! vuln]ability disclosure program ( ! ag5cy "u section #ceei;,b2 7,,iv7 incid5ts2 & 7,v7 any o!r vuln]ability in=mation relat+ to ag5cy sy/ems t is kn[n to ! ag5cy2 7vii7 assess+ ! impacts ( pot5tial ag5cy incid5ts to ag5cy sy/ems1 data1 & op]ations bas$ on ! evaluations describ$ 9 clauses 7ii7 & 7v7 & ! ag5cy sy/ems id5tifi$ "u clause 7iv72 & 7viii7 assess+ ! consequ5ces ( pot5tial incid5ts occurr+ on ag5cy sy/ems t w\ld impact sy/ems at o!r ag5cies1 includ+ due to int]connectivity betwe5 diff]5t ag5cy sy/ems or op]ational reliance on ! op]ations ( ! sy/em or data 9 ! sy/em2 2 7,,iii7 9 subp>agraph 7,b71 z s r$esignat$1 9 ! matt] prec$+ clause 7i71 by /rik+ provid+ in=mation & ins]t+ us+ in=mation f ! assessm5t requir$ "u subp>agraph 7,a71 provid+ in=mation2 7,,iv7 9 subp>agraph 7,c71 z s r$esignat$-- 7aa7 9 clause 7ii7 by ins]t+ b9d+ be=e op]ational2 & 7bb7 9 clause 7vi71 by /rik+ & at ! end2 7,v7 9 subp>agraph 7,d71 z s r$esignat$1 by ins]t+ & aft] ! semicolon at ! end2 & 7,,vi7 by add+ at ! end ! foll[+3 7,e7 provid+ an update on ! ongo+ & cont9ual assessm5t requir$ "u subp>agraph 7,a7-- 7i7 ^u reque/1 to ! inspector g5]al ( ! ag5cy or ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates2 & 7ii7 at int]vals det]m9$ by guidance issu$ by ! ,director1 & to ! ext5t appropriate & practicable us+ automation1 to-- 7,i7 ! ,director2 7,,ii7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,,iii7 ! ,national ,cyb] ,director2 2 7ii7 9 p>agraph 7#b7-- 7,i7 9 subp>agraph 7,a71 by ins]t+ 9 accordance ) ! ag5cy sy/em risk assessm5t requir$ "u p>agraph 7#a77;,a7 aft] in=mation sy/ems2 & 7,,ii7 9 subp>agraph 7,d71 by ins]t+ 1 ?r\gh ! use ( p5etration te/+1 ! vuln]ability disclosure program e/abli%$ "u section #ceei;,b1 & o!r means1 aft] p]iodically2 7iii7 9 p>agraph 7#c77;,a7-- 7,i7 9 ! matt] prec$+ clause 7i71 by /rik+ s5ior ag5cy in=mation security (fic] & ins]t+ ,*ief ,in=mation ,security ,(fic]2 7,,ii7 9 clause 7i71 by /rik+ ?is section & ins]t+ subsections 7a7 ?r\gh 7c72 7,,iii7 9 clause 7ii71 by /rik+ tra9+ & & ins]t+ skills1 tra9+1 &2 7,,iv7 by r$esignat+ clauses 7iii7 & 7iv7 z clauses 7iv7 & 7v71 respectively2 7,v7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 manage in=mation security1 cyb]security budgets1 & risk & compliance activities & expla9 ^? concepts to ! head ( ! ag5cy & ! executive team ( ! ag5cy2 2 & 7,,vi7 9 clause 7iv71 z s r$esignat$1 by /rik+ in=mation security duties z t (ficial's prim>y duty & ins]t+ in=mation1 comput] network1 & te*nology security duties z ! ,*ief ,in=mation ,security ,(fic]s' prim>y duty2 7iv7 9 p>agraph 7#e71 by /rik+ annually & ins]t+ n less frequ5tly ?an qu>t]ly2 & 7v7 9 p>agraph 7#f71 by /rik+ (ficial delegat$ & ins]t+ ,*ief ,in=mation ,security ,(fic] delegat$2 7,b7 9 subsection 7b7-- 7i7 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 ! ongo+ & cont9ual assessm5t ( ag5cy sy/em risk requir$ "u subsection 7a77#a77;,a71 :i* may include us+ guidance & automat$ tools consi/5t ) /&>ds & guidel9es promulgat$ "u section #aacca ( title #dj1 z applicable2 2 7ii7 9 p>agraph 7#b7-- 7,i7 by /rik+ subp>agraph 7,b72 7,,ii7 by r$esignat+ subp>agraphs 7,c7 & 7,d7 z subp>agraphs 7,b7 & 7,c71 respectively2 & 7,,iii7 9 subp>agraph 7,c71 z s r$esignat$-- 7aa7 by r$esignat+ clauses 7iii7 & 7iv7 z clauses 7iv7 & 7v71 respectively2 7bb7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 b9d+ op]ational directives & em]g5cy directives issu$ by ! ,secret>y "u section #ceec2 2 & 7cc7 9 clause 7iv71 z s r$esignat$1 by /rik+ z det]m9$ by ! ag5cy2 & ins]t+ z det]m9$ by ! ag5cy1 consid]+ ! ag5cy risk assessm5t requir$ "u subsection 7a77#a77;,a722 7iii7 9 p>agraph 7#e77;,a71 by ins]t+ 1 includ+ p5etration te/+1 z appropriate1 aft] %all include te/+2 7iv7 by r$esignat+ p>agraphs 7#g7 & 7#h7 z p>agraphs 7#h7 & 7#i71 respectively2 7v7 by ins]t+ aft] p>agraph 7#f7 ! foll[+3 7#g7 a process = securely provid+ ! /atus ( rem$ial cyb]security actions & un-rem$iat$ id5tifi$ sy/em vuln]abilities ( high value assets to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 us+ automation & ma*9e-readable data z appropriate2 2 & 7vi7 9 p>agraph 7#h77;,c71 z s r$esignat$-- 7,i7 by /rik+ clause 7ii7 & ins]t+ ! foll[+3 7ii7 notify+ & consult+ ) ! ,f$]al in=mation security incid5t c5t] e/abli%$ "u section #ceef pursuant to ! requirem5ts ( section #ceid2 2 7,,ii7 by r$esignat+ clause 7iii7 z clause 7iv72 7,,iii7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 p]=m+ ! notifications & o!r activities requir$ "u sub*apt] ,,iv ( ?is *apt]2 & 2 & 7,,iv7 9 clause 7iv71 z s r$esignat$-- 7aa7 9 subclause 7,,ii71 by add+ & at ! end2 7bb7 by /rik+ subclause 7,,iii72 & 7cc7 by r$esignat+ subclause 7,,iv7 z subclause 7,,iii72 & 7,c7 9 subsection 7c7-- 7i7 by r$esignat+ p>agraph 7#b7 z p>agraph 7#d72 7ii7 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 ,bi5nial report ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbd & n less frequ5tly ?an once e #b ye>s !reaft]1 us+ ! ongo+ & cont9ual ag5cy sy/em risk assessm5t requir$ "u subsection 7a77#a77;,a71 ! head ( ea* ag5cy %all submit to ! ,director1 ! ,national ,cyb] ,director1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 ! majority & m9ority lead]s ( ! ,s5ate1 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate1 ! ,committee on ,sci5ce1 ,space1 & ,te*nology ( ! ,h\se ( ,repres5tatives1 & ! appropriate au?orization & appropriations committees ( ,congress a report t-- 7,a7 summ>izes ! ag5cy sy/em risk assessm5t requir$ "u subsection 7a77#a77;,a72 7,b7 evaluates ! adequacy & effectiv5ess ( in=mation security policies1 proc$ures1 & practices ( ! ag5cy to address ! risks id5tifi$ 9 ! ag5cy sy/em risk assessm5t requir$ "u subsection 7a77#a77;,a71 includ+ an analysis ( ! ag5cy's cyb]security & incid5t response capabilities us+ ! metrics e/abli%$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c772 7,c7 summ>izes ! /atus ( rem$ial actions id5tifi$ by inspector g5]al ( ! ag5cy1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 & any o!r s\rce det]m9$ appropriate by ! head ( ! ag5cy2 & 7,d7 includes ! cyb]security %>$ s]vices (f]$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy t ! ag5cy p>ticipates 91 if any1 & explanations = any non-p>ticipation 9 su* s]vices4 7#b7 ,unclassifi$ reports ,ea* report submitt$ "u p>agraph 7#a7-- 7,a7 %all be1 to ! greate/ ext5t practicable1 9 an unclassifi$ & o!rwise uncontroll$ =m2 & 7,b7 may include #a or m annexes t conta9 classifi$ or o!r s5sitive in=mation1 z appropriate4 7#c7 ,brief+s ,dur+ ea* ye> dur+ :i* a report is n requir$ to be submitt$ "u p>agraph 7#a71 ! ,director %all provide to ! congressional committees describ$ 9 p>agraph 7#a7 a brief+ summ>iz+ curr5t ag5cy & ,f$]al risk po/ures4 2 & 7iii7 9 p>agraph 7#d71 z s r$esignat$1 by /rik+ ! p]iod at ! end & ins]t+ 1 includ+ ! report+ proc$ures e/abli%$ "u section #aacae7;d7 ( title #dj & subsection 7a77#c77;,a77v7 ( ?is section42 7#d7 9 section #ceee-- 7,a7 9 ! section head+1 by /rik+ ,annual indep5d5t & ins]t+ ,indep5d5t2 7,b7 9 subsection 7a7-- 7i7 9 p>agraph 7#a71 by ins]t+ dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c71 aft] ,ea* ye>2 7ii7 9 p>agraph 7#b77;,a71 by ins]t+ 1 includ+ by p]=m+1 or review+ ! results (1 ag5cy p5etration te/+ & analyz+ ! vuln]ability disclosure program ( ! ag5cy aft] in=mation sy/ems2 & 7iii7 by add+ at ! end ! foll[+3 7#c7 ,an evaluation "u ?is section may include recomm5dations = improv+ ! cyb]security po/ure ( ! ag5cy4 2 7,c7 9 subsection 7b77#a71 by /rik+ annual2 7,d7 9 subsection 7e77#a71 by ins]t+ dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 aft] ,ea* ye>2 7,e7 9 subsection 7g77#b7-- 7i7 by /rik+ ?is subsection %all & ins]t+ 8?is subsection-- 7,a7 %all 2 7ii7 9 subp>agraph 7,a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,b7 id5tify any entity t p]=ms an indep5d5t evaluation "u subsection 7b74 2 7,f7 by /rik+ subsection 7j7 & ins]t+ ! foll[+3 7j7 ,guidance 7#a7 ,9 g5]al ,! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,*ief ,in=mation ,(fic]s ,c\ncil1 ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 & o!r int]e/$ p>ties z appropriate1 %all ensure ! developm5t ( risk-bas$ guidance = evaluat+ ! effectiv5ess ( an in=mation security program & practices4 7#b7 ,priorities ,! risk-bas$ guidance develop$ "u p>agraph 7#a7 %all include-- 7,a7 ! id5tification ( ! mo/ common successful ?reat patt]ns2 7,b7 ! id5tification ( security controls t address ! ?reat patt]ns describ$ 9 subp>agraph 7,a72 7,c7 any o!r security risks unique to ,f$]al sy/ems2 & 7,d7 any o!r elem5t ! ,director det]m9es appropriate4 2 & 7,g7 by add+ at ! end ! foll[+3 7k7 ,coord9ation ,! head ( ea* ag5cy %all coord9ate ) ! inspector g5]al ( ! ag5cy1 z applicable1 to ensure consi/5t und]/&+ ( ag5cy cyb]security or in=mation security policies = ! purpose ( evaluations ( su* policies conduct$ by ! inspector g5]al4 2 & 7#e7 9 section #ceef7;a7-- 7,a7 9 ! matt] prec$+ p>agraph 7#a71 by ins]t+ )9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy aft] incid5t c5t]2 & 7,b7 9 p>agraph 7#d71 by /rik+ #ceed7;b7 & ins]t+ #ceed7;a77#a77;,a74 7d7 ,con=m+ am5dm5ts 7#a7 ,table ( sections ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! item relat+ to section #ceee & ins]t+ ! foll[+3 #ceee4 ,indep5d5t evaluation4 4 7#b7 ,,omb reports ,section #bbf7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebd7;c77 is am5d$-- 7,a7 9 p>agraph 7#a77;,b71 9 ! matt] prec$+ clause 7i71 by /rik+ annually !reaft] & ins]t+ !reaft] dur+ ! ye>s dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code2 & 7,b7 9 p>agraph 7#b77;,b71 9 ! matt] prec$+ clause 7i7-- 7i7 by /rik+ annually !reaft] & ins]t+ !reaft] dur+ ! ye>s dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code2 & 7ii7 by /rik+ ! report requir$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code & ins]t+ t report4 7#c7 ,,ni/ responsibilities ,section #bj7;d77#c77;,b7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;d77#c77;,b77 is am5d$ by /rik+ annual4 7e7 ,f$]al sy/em incid5t response 7#a7 ,9 g5]al ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 ,,iv ,f$]al sy/em incid5t response #ceia4 ,def9itions 7a7 ,9 g5]al ,except z provid$ 9 subsection 7b71 ! def9itions "u sections #cejb & #ceeb %all apply to ?is sub*apt]4 7b7 ,additional def9itions ,z us$ 9 ?is sub*apt]3 7#a7 ,appropriate report+ entities ,! t]m appropriate report+ entities means-- 7,a7 ! majority & m9ority lead]s ( ! ,s5ate2 7,b7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7,c7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,d7 ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate2 7,e7 ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives2 7,f7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives2 7,g7 ! ,committee on ,sci5ce1 ,space1 & ,te*nology ( ! ,h\se ( ,repres5tatives2 7,h7 ! appropriate au?orization & appropriations committees ( ,congress2 7,i7 ! ,director2 7,j7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,k7 ! ,national ,cyb] ,director2 7,l7 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates2 & 7,m7 ! inspector g5]al ( any impact$ ag5cy4 7#b7 ,aw>dee ,! t]m aw>dee1 ) respect to an ag5cy-- 7,a7 means-- 7i7 ! recipi5t ( a grant f an ag5cy2 7ii7 a p>ty to a coop]ative agreem5t ) an ag5cy2 & 7iii7 a p>ty to an o!r transaction agreem5t ) an ag5cy2 & 7,b7 includes a subaw>dee ( an entity describ$ 9 subp>agraph 7,a74 7#c7 ,brea* ,! t]m brea*-- 7,a7 means ! compromise1 unau?oriz$ disclosure1 unau?oriz$ acquisition1 or loss ( control ( p]sonally id5tifiable in=mation own$1 ma9ta9$ or o!rwise controll$ by an ag5cy1 or any simil> occurr5ce2 & 7,b7 includes any additional mean+ giv5 ! t]m 9 policies1 pr9ciples1 /&>ds1 or guidel9es issu$ by ! ,director4 7#d7 ,contractor ,! t]m contractor means a prime contractor ( an ag5cy or a subcontractor ( a prime contractor ( an ag5cy t creates1 collects1 /ores1 processes1 ma9ta9s1 or transmits ,f$]al in=mation on behalf ( an ag5cy4 7#e7 ,f$]al in=mation ,! t]m ,f$]al in=mation means in=mation creat$1 collect$1 process$1 ma9ta9$1 dissem9at$1 disclos$1 or dispos$ ( by or = ! ,f$]al ,gov]nm5t 9 any m$ium or =m4 7#f7 ,f$]al in=mation sy/em ,! t]m ,f$]al in=mation sy/em means an in=mation sy/em own$1 manag$1 or op]at$ by an ag5cy1 or on behalf ( an ag5cy by a contractor1 an aw>dee1 or ano!r organization4 7#g7 ,intellig5ce community ,! t]m intellig5ce community has ! mean+ giv5 ! t]m 9 section #c ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjjc74 7#h7 ,nationwide consum] report+ ag5cy ,! t]m nationwide consum] report+ ag5cy means a consum] report+ ag5cy describ$ 9 section #fjc7p7 ( ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#i7 ,vuln]ability disclosure ,! t]m vuln]ability disclosure means a vuln]ability id5tifi$ "u section #ceei;,b4 #ceib4 ,notification ( brea* 7a7 ,def9ition ,9 ?is section1 ! t]m cov]$ brea* means a brea*-- 7#a7 involv+ n less ?an #ej1jjj pot5tially affect$ individuals2 or 7#b7 ! result ( :i* ! head ( an ag5cy det]m9es t notify+ pot5tially affect$ individuals is necess>y pursuant to subsection 7b77#a71 reg>dless ( :e!r-- 7,a7 ! numb] ( pot5tially affect$ individuals is less ?an #ej1jjj2 or 7,b7 ! notification is delay$ "u subsection 7d74 7b7 ,notification ,z exp$iti\sly z practicable & )\t unreasonable delay1 & 9 any case n lat] ?an #de days aft] an ag5cy has a reasonable basis to conclude t a brea* has occurr$1 ! head ( ! ag5cy1 9 consultation ) ! ,*ief ,in=mation ,(fic] & ,*ief ,privacy ,(fic] ( ! ag5cy &1 z appropriate1 any non-,f$]al entity support+ ! rem$iation ( ! brea*1 %all-- 7#a7 det]m9e :e!r notice to any individual pot5tially affect$ by ! brea* is appropriate1 includ+ by conduct+ an assessm5t ( ! risk ( h>m to ! individual t consid]s-- 7,a7 ! nature & s5sitivity ( ! p]sonally id5tifiable in=mation affect$ by ! brea*2 7,b7 ! likelihood ( access to & use ( ! p]sonally id5tifiable in=mation affect$ by ! brea*2 7,c7 ! type ( brea*2 & 7,d7 any o!r factors det]m9$ by ! ,director2 & 7#b7 if ! head ( ! ag5cy det]m9es notification is necess>y pursuant to p>agraph 7#a71 provide writt5 notification 9 accordance ) subsection 7c7 to ea* individual pot5tially affect$ by ! brea*-- 7,a7 to ! la/ kn[n mail+ address ( ! individual2 or 7,b7 ?r\gh an appropriate alt]native me?od ( notification4 7c7 ,cont5ts ( notification ,ea* notification ( a brea* provid$ to an individual "u subsection 7b77#b7 %all include1 to ! maximum ext5t practicable-- 7#a7 a brief description ( ! brea*2 7#b7 if possible1 a description ( ! types ( p]sonally id5tifiable in=mation affect$ by ! brea*2 7#c7 contact in=mation ( ! ag5cy t may be us$ to ask que/ions ( ! ag5cy1 :i*-- 7,a7 %all include an e-mail address or ano!r digital contact me*anism2 & 7,b7 may include a telephone numb]1 mail+ address1 or a website2 7#d7 in=mation on any rem$y be+ (f]$ by ! ag5cy2 7#e7 any applicable educational mat]ials relat+ to :at individuals c d 9 response to a brea* t pot5tially affects _! p]sonally id5tifiable in=mation1 includ+ relevant contact in=mation = ! appropriate ,f$]al law en=cem5t ag5cies & ea* nationwide consum] report+ ag5cy2 & 7#f7 any o!r appropriate in=mation1 z det]m9$ by ! head ( ! ag5cy or e/abli%$ 9 guidance by ! ,director4 7d7 ,delay ( notification 7#a7 ,9 g5]al ,! head ( an ag5cy1 9 coord9ation ) ! ,director & ! ,national ,cyb] ,director1 & z appropriate1 ! ,attorney ,g5]al1 ! ,director ( ,national ,intellig5ce1 or ! ,secret>y ( ,homel& ,security1 may delay a notification requir$ "u subsection 7b7 or 7e7 if ! notification w\ld-- 7,a7 imp$e a crim9al inve/igation or a national security activity2 7,b7 cause an adv]se result 7z describ$ 9 section #bgje7;a77#b7 ( title #ah72 7,c7 reveal s5sitive s\rces & me?ods2 7,d7 cause damage to national security2 or 7,e7 hamp] security rem$iation actions4 7#b7 ,r5ewal ,a delay "u p>agraph 7#a7 %all be = a p]iod ( #fj days & may be r5ew$4 7#c7 ,national security sy/ems ,! head ( an ag5cy delay+ notification "u ?is subsection ) respect to a brea* exclusively ( a national security sy/em %all coord9ate su* delay ) ! ,secret>y ( ,def5se4 7e7 ,update notification ,if an ag5cy det]m9es !re is a significant *ange 9 ! reasonable basis to conclude t a brea* occurr$1 a significant *ange to ! det]m9ation made "u subsection 7b77#a71 or t x is necess>y to update ! details ( ! in=mation provid$ to pot5tially affect$ individuals z describ$ 9 subsection 7c71 ! ag5cy %all z exp$iti\sly z practicable & )\t unreasonable delay1 & 9 any case n lat] ?an #cj days aft] su* a det]m9ation1 notify ea* individual :o receiv$ a notification pursuant to subsection 7b7 ( ^? *anges4 7f7 ,delay ( notification report 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbd1 & annually !reaft]1 ! head ( an ag5cy1 9 coord9ation ) any (ficial :o delays a notification "u subsection 7d71 %all submit to ! appropriate report+ entities a report on ea* delay t occurr$ dur+ ! previ\s #b ye>s4 7#b7 ,compon5t ( o!r report ,! head ( an ag5cy may submit ! report requir$ "u p>agraph 7#a7 z a compon5t ( ! report submitt$ "u section #ceed7;c74 7g7 ,congressional report+ requirem5ts 7#a7 ,review & update ,on a p]iodic basis1 ! ,director ( ! ,(fice ( ,managem5t & ,budget %all review1 & update z appropriate1 brea* notification policies & guidel9es = ag5cies4 7#b7 ,requir$ notice f ag5cies ,subject to p>agraph 7#d71 ! ,director ( ! ,(fice ( ,managem5t & ,budget %all require ! head ( an ag5cy affect$ by a cov]$ brea* to exp$iti\sly & n lat] ?an #cj days aft] ! date on :i* ! ag5cy discov]s ! cov]$ brea* give notice ( ! brea*1 :i* may be provid$ electronically1 to-- 7,a7 ea* congressional committee describ$ 9 section #ceed7;c77#a72 & 7,b7 ! ,committee on ! ,judici>y ( ! ,s5ate & ! ,committee on ! ,judici>y ( ! ,h\se ( ,repres5tatives4 7#c7 ,cont5ts ( notice ,notice ( a cov]$ brea* provid$ by ! head ( an ag5cy pursuant to p>agraph 7#b7 %all include1 to ! ext5t practicable-- 7,a7 in=mation ab\t ! cov]$ brea*1 includ+ a summ>y ( any in=mation ab\t h[ ! cov]$ brea* occurr$ kn[n by ! ag5cy z ( ! date ( ! notice2 7,b7 an e/imate ( ! numb] ( individuals affect$ by ! cov]$ brea* bas$ on in=mation kn[n by ! ag5cy z ( ! date ( ! notice1 includ+ an assessm5t ( ! risk ( h>m to affect$ individuals2 7,c7 a description ( any circum/ances necessitat+ a delay 9 provid+ notice to individuals affect$ by ! cov]$ brea* 9 accordance ) subsection 7d72 & 7,d7 an e/imate ( :5 ! ag5cy w provide notice to individuals affect$ by ! cov]$ brea*1 if applicable4 7#d7 ,exception ,any ag5cy t is requir$ to provide notice to ,congress pursuant to p>agraph 7#b7 due to a cov]$ brea* exclusively on a national security sy/em %all only provide su* notice to-- 7,a7 ! majority & m9ority lead]s ( ! ,s5ate2 7,b7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7,c7 ! appropriations committees ( ,congress2 7,d7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,e7 ! ,select ,committee on ,intellig5ce ( ! ,s5ate2 7,f7 ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives2 & 7,g7 ! ,p]man5t ,select ,committee on ,intellig5ce ( ! ,h\se ( ,repres5tatives4 7#e7 ,rule ( con/ruction ,no?+ 9 p>agraphs 7#a7 ?r\gh 7#c7 %all be con/ru$ to alt] any au?ority ( an ag5cy4 7h7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to-- 7#a7 limit-- 7,a7 ! au?ority ( ! ,director to issue guidance relat+ to notifications (1 or ! head ( an ag5cy to notify individuals pot5tially affect$ by1 brea*es t are n det]m9$ to be cov]$ brea*es or major incid5ts2 7,b7 ! au?ority ( ! ,director to issue guidance relat+ to notifications & report+ ( brea*es1 cov]$ brea*es1 or major incid5ts2 7,c7 ! au?ority ( ! head ( an ag5cy to provide m in=mation ?an requir$ "u subsection 7b7 :5 notify+ individuals pot5tially affect$ by a brea*2 7,d7 ! tim+ ( incid5t report+ or ! types ( in=mation includ$ 9 incid5t reports provid$1 pursuant to ?is sub*apt]1 to-- 7i7 ! ,director2 7ii7 ! ,national ,cyb] ,director2 7iii7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 or 7iv7 any o!r ag5cy2 7,e7 ! au?ority ( ! head ( an ag5cy to provide in=mation to ,congress ab\t ag5cy brea*es1 includ+-- 7i7 brea*es t are n cov]$ brea*es2 & 7ii7 additional in=mation beyond ! in=mation describ$ 9 subsection 7g77#c72 or 7,f7 any congressional report+ requirem5ts ( ag5cies "u any o!r law2 or 7#b7 limit or sup]s$e any exi/+ privacy protections 9 exi/+ law4 #ceic4 ,congressional & executive bran* reports on major incid5ts 7a7 ,appropriate congressional entities ,9 ?is section1 ! t]m appropriate congressional entities means-- 7#a7 ! majority & m9ority lead]s ( ! ,s5ate2 7#b7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7#c7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7#d7 ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate2 7#e7 ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives2 7#f7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives2 7#g7 ! ,committee on ,sci5ce1 ,space1 & ,te*nology ( ! ,h\se ( ,repres5tatives2 & 7#h7 ! appropriate au?orization & appropriations committees ( ,congress4 7b7 ,initial notification 7#a7 ,9 g5]al ,n lat] ?an #gb h\rs aft] an ag5cy has a reasonable basis to conclude t a major incid5t occurr$1 ! head ( ! ag5cy impact$ by ! major incid5t %all submit to ! appropriate report+ entities a writt5 notification1 :i* may be submitt$ electronically & include #a or m annexes t conta9 classifi$ or o!r s5sitive in=mation1 z appropriate4 7#b7 ,cont5ts ,a notification requir$ "u p>agraph 7#a7 ) respect to a major incid5t %all include ! foll[+1 bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy submits ! notification3 7,a7 ,a summ>y ( ! in=mation available ab\t ! major incid5t1 includ+ h[ ! major incid5t occurr$ & ! ?reat caus+ ! major incid5t4 7,b7 ,if applicable1 in=mation relat+ to any brea* associat$ ) ! major incid5t1 reg>dless ( :e!r-- 7i7 ! brea* 0 ! reason ! incid5t 0 det]m9$ to be a major incid5t2 & 7ii7 head ( ! ag5cy det]m9$ x 0 appropriate to provide notification to pot5tially impact$ individuals pursuant to section #ceib7;b77#a74 7,c7 ,a prelim9>y assessm5t ( ! impacts to-- 7i7 ! ag5cy2 7ii7 ! ,f$]al ,gov]nm5t2 7iii7 ! national security1 =eign relations1 homel& security1 & economic security ( ! ,unit$ ,/ates2 & 7iv7 ! civil lib]ties1 public confid5ce1 privacy1 & public heal? & safety ( ! p ( ! ,unit$ ,/ates4 7,d7 ,if applicable1 :e!r any ransom has be5 dem&$ or paid1 or is expect$ to be paid1 by any entity op]at+ a ,f$]al in=mation sy/em or ) access to ,f$]al in=mation or a ,f$]al in=mation sy/em1 includ+1 z available1 ! "n ( ! entity dem&+ ransom1 ! date ( ! dem&1 & ! am\nt & type ( curr5cy dem&$1 unless disclosure ( su* in=mation w disrupt an active ,f$]al law en=cem5t or national security op]ation4 7c7 ,supplem5tal update ,)9 a reasonable am\nt ( "t1 b n lat] ?an #cj days aft] ! date on :i* ! head ( an ag5cy submits a writt5 notification "u subsection 7b71 ! head ( ! ag5cy %all provide to ! appropriate congressional entities an unclassifi$ & writt5 update1 :i* may include #a or m annexes t conta9 classifi$ or o!r s5sitive in=mation1 z appropriate1 on ! major incid5t1 bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy provides ! update1 on-- 7#a7 sy/em vuln]abilities relat+ to ! major incid5t1 :]e applicable1 means by :i* ! major incid5t occurr$1 ! ?reat caus+ ! major incid5t1 :]e applicable1 & impacts ( ! major incid5t to-- 7,a7 ! ag5cy2 7,b7 o!r ,f$]al ag5cies1 ,congress1 or ! judicial bran*2 7,c7 ! national security1 =eign relations1 homel& security1 or economic security ( ! ,unit$ ,/ates2 or 7,d7 ! civil lib]ties1 public confid5ce1 privacy1 or public heal? & safety ( ! p ( ! ,unit$ ,/ates2 7#b7 ! /atus ( compliance ( ! affect$ ,f$]al in=mation sy/em ) applicable security requirem5ts at ! "t ( ! major incid5t2 7#c7 if ! major incid5t involv$ a brea*1 a description ( ! affect$ in=mation1 an e/imate ( ! numb] ( individuals pot5tially impact$1 & any assessm5t to ! risk ( h>m to su* individuals2 7#d7 an update to ! assessm5t ( ! risk to ag5cy op]ations1 or to impacts on o!r ag5cy or non-,f$]al entity op]ations1 affect$ by ! major incid5t2 7#e7 ! detection1 response1 & rem$iation actions ( ! ag5cy1 includ+ any support provid$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u section #ceid7;d71 if applicable2 7#f7 z appropriate & available1 actions und]tak5 by any non-,f$]al entities impact$ by or support+ rem$iation ( ! major incid5t2 & 7#g7 z appropriate & available1 recomm5dations = mitigat+ future simil> incid5ts1 includ+ recomm5dations f any non-,f$]al entity impact$ by or support+ ! rem$iation ( ! major incid5t4 7d7 ,additional update ,if ! head ( an ag5cy1 ! ,director1 or ! ,national ,cyb] ,director det]m9es t !re is any significant *ange 9 ! und]/&+ ( ! scope1 scale1 or consequ5ce ( a major incid5t = :i* ! head ( ! ag5cy submitt$ a writt5 notification & update "u subsections 7b7 & 7c71 ! head ( ! ag5cy %all submit to ! appropriate congressional entities a writt5 update t includes in=mation relat+ to ! *ange 9 und]/&+4 7e7 ,bi5nial report ,ea* ag5cy %all submit z "p ( ! bi5nial report requir$ "u section #ceed7;c77#a7 a description ( ea* major incid5t t occurr$ dur+ ! #b-ye> p]iod prec$+ ! date on :i* ! bi5nial report is submitt$4 7f7 ,report deliv]y 7#a7 ,9 g5]al ,any writt5 notification or update requir$ to be submitt$ "u ?is section-- 7,a7 %all be submitt$ 9 an electronic =mat2 & 7,b7 may be submitt$ 9 a pap] =mat4 7#b7 ,classification /atus ,any writt5 notification or update requir$ to be submitt$ "u ?is section-- 7,a7 %all be-- 7i7 unclassifi$2 & 7ii7 submitt$ ?r\gh unclassifi$ electronic means pursuant to p>agraph 7#a77;,a72 & 7,b7 may include classifi$ annexes1 z appropriate4 7g7 ,report consi/5cy ,to a*ieve consi/5t & coh]5t ag5cy report+ to ,congress1 ! ,national ,cyb] ,director1 9 coord9ation ) ! ,director1 %all-- 7#a7 provide recomm5dations to ag5cies on =matt+ & ! cont5ts ( in=mation to be includ$ 9 ! reports requir$ "u ?is section1 includ+ recomm5dations = consi/5t =mats = pres5t+ any associat$ metrics2 & 7#b7 ma9ta9 a compreh5sive record ( ea* major incid5t notification1 update1 & brief+ provid$ "u ?is section1 :i* %all-- 7,a7 include1 at a m9imum-- 7i7 ! full cont5ts ( ! writt5 notification or update2 7ii7 ! id5tity ( ! report+ ag5cy2 & 7iii7 ! date ( submission2 & 7iv7 a li/ ( ! recipi5t congressional entities2 & 7,b7 be made available ^u reque/ to ! majority & m9ority lead]s ( ! ,s5ate1 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 & ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives4 7h7 ,national security sy/ems congressional report+ exemption ,) respect to a major incid5t t occurs exclusively on a national security sy/em1 ! head ( ! affect$ ag5cy %all submit ! notifications & reports requir$ to be submitt$ to ,congress "u ?is section only to-- 7#a7 ! majority & m9ority lead]s ( ! ,s5ate2 7#b7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7#c7 ! appropriations committees ( ,congress2 7#d7 ! appropriate au?orization committees ( ,congress2 7#e7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7#f7 ! ,select ,committee on ,intellig5ce ( ! ,s5ate2 7#g7 ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives2 & 7#h7 ! ,p]man5t ,select ,committee on ,intellig5ce ( ! ,h\se ( ,repres5tatives4 7i7 ,major incid5ts includ+ brea*es ,if a major incid5t con/itutes a cov]$ brea*1 z def9$ 9 section #ceib7;a71 in=mation on ! cov]$ brea* requir$ to be submitt$ to ,congress pursuant to section #ceib7;g7 may-- 7#a7 be includ$ 9 ! notifications requir$ "u subsection 7b7 or 7c72 or 7#b7 be report$ to ,congress "u ! process e/abli%$ "u section #ceib7;g74 7j7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to-- 7#a7 limit-- 7,a7 ! ability ( an ag5cy to provide additional reports or brief+s to ,congress2 7,b7 ,congress f reque/+ additional in=mation f ag5cies ?r\gh reports1 brief+s1 or o!r means2 & 7,c7 any congressional report+ requirem5ts ( ag5cies "u any o!r law2 or 7#b7 limit or sup]s$e any privacy protections "u any o!r law4 #ceid4 ,gov]nm5t in=mation %>+ & incid5t response 7a7 ,9 g5]al 7#a7 ,incid5t %>+ ,subject to p>agraph 7#d7 & subsection 7b71 & 9 accordance ) ! applicable requirem5ts pursuant to section #ceec7;b77#b77;,a7 = report+ to ! ,f$]al in=mation security incid5t c5t] e/abli%$ "u section #ceef1 ! head ( ea* ag5cy %all provide to ! ,cyb]security & ,infra/ructure ,security ,ag5cy in=mation relat+ to any incid5t affect+ ! ag5cy1 :e!r ! in=mation is obta9$ by ! ,f$]al ,gov]nm5t directly or indirectly4 7#b7 ,cont5ts ,a provision ( in=mation relat+ to an incid5t made by ! head ( an ag5cy "u p>agraph 7#a7 %all include1 at a m9imum-- 7,a7 a full description ( ! incid5t1 includ+-- 7i7 all indicators ( compromise & tactics1 te*niques1 & proc$ures2 7ii7 an indicator ( h[ ! intrud] ga9$ initial access1 access$ ag5cy data or sy/ems1 & und]took additional actions on ! network ( ! ag5cy2 7iii7 in=mation t w\ld support enabl+ def5sive measures2 & 7iv7 o!r in=mation t may assi/ 9 id5tify+ o!r victims2 7,b7 in=mation to help prev5t simil> incid5ts1 su* z in=mation ab\t relevant safegu>ds 9 place :5 ! incid5t occurr$ & ! effectiv5ess ( ^? safegu>ds2 & 7,c7 in=mation to aid 9 incid5t response1 su* z-- 7i7 a description ( ! affect$ sy/ems or networks2 7ii7 ! e/imat$ dates ( :5 ! incid5t occurr$2 & 7iii7 in=mation t c\ld reasonably help id5tify any malici\s actor t may h conduct$ or caus$ ! incid5t1 subject to appropriate privacy protections4 7#c7 ,in=mation %>+ ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7,a7 make incid5t in=mation provid$ "u p>agraph 7#a7 available to ! ,director & ! ,national ,cyb] ,director2 7,b7 to ! greate/ ext5t practicable1 %>e in=mation relat+ to an incid5t )-- 7i7 ! head ( any ag5cy t may be-- 7,i7 impact$ by ! incid5t2 7,,ii7 p>ticul>ly susceptible to ! incid5t2 or 7,,iii7 simil>ly t>get$ by ! incid5t2 & 7ii7 appropriate ,f$]al law en=cem5t ag5cies to facilitate any necess>y ?reat response activities1 z reque/$2 7,c7 coord9ate any necess>y in=mation %>+ ef=ts relat+ to a major incid5t ) ! private sector2 & 7,d7 notify ! ,national ,cyb] ,director ( any ef=ts describ$ 9 subp>agraph 7,c74 7#d7 ,national security sy/ems exemption 7,a7 ,9 g5]al ,not)/&+ p>agraphs 7#a7 & 7#c71 ea* ag5cy op]at+ or ex]cis+ control ( a national security sy/em %all %>e in=mation ab\t an incid5t t occurs exclusively on a national security sy/em ) ! ,secret>y ( ,def5se1 ! ,director1 ! ,national ,cyb] ,director1 & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy to ! ext5t consi/5t ) /&>ds & guidel9es = national security sy/ems issu$ 9 accordance ) law & z direct$ by ! ,presid5t4 7,b7 ,protections ,any in=mation %>+ & h&l+ ( in=mation "u ?is p>agraph %all be appropriately protect$ consi/5t ) proc$ures au?oriz$ = ! protection ( s5sitive s\rces & me?ods or by proc$ures e/abli%$ = in=mation t h be5 specifically au?oriz$ "u crit]ia e/abli%$ by an ,executive ord] or an ,act ( ,congress to be kept classifi$ 9 ! int]e/ ( national def5se or =eign policy4 7b7 ,automation ,9 provid+ in=mation & select+ a me?od to provide in=mation "u subsection 7a71 ! head ( ea* ag5cy %all implem5t subsection 7a77#a7 9 a mann] t provides su* in=mation to ! ,cyb]security & ,infra/ructure ,security ,ag5cy 9 an automat$ & ma*9e-readable =mat1 to ! greate/ ext5t practicable4 7c7 ,incid5t response ,ea* ag5cy t has a reasonable basis to suspect or conclude t a major incid5t occurr$ involv+ ,f$]al in=mation 9 electronic m$ium or =m t does n exclusively involve a national security sy/em %all coord9ate )-- 7#a7 ! ,cyb]security & ,infra/ructure ,security ,ag5cy to facilitate asset response activities & provide recomm5dations = mitigat+ future incid5ts2 & 7#b7 consi/5t ) relevant policies1 appropriate ,f$]al law en=cem5t ag5cies to facilitate ?reat response activities4 #ceie4 ,responsibilities ( contractors & aw>dees 7a7 ,notification 7#a7 ,9 g5]al ,any contractor or aw>dee ( an ag5cy %all provide writt5 notification to ! ag5cy if ! contractor or aw>dee has a reasonable basis to conclude t-- 7,a7 an incid5t or brea* has occurr$ ) respect to ,f$]al in=mation ! contractor or aw>dee collect$1 us$1 or ma9ta9$ on behalf ( an ag5cy2 7,b7 an incid5t or brea* has occurr$ ) respect to a ,f$]al in=mation sy/em us$1 op]at$1 manag$1 or ma9ta9$ on behalf ( an ag5cy by ! contractor or aw>dee2 7,c7 a compon5t ( any ,f$]al in=mation sy/em op]at$1 manag$1 or ma9ta9$ by a contractor or aw>dee conta9s a security vuln]ability1 includ+ a supply *a9 compromise or an id5tifi$ s(tw>e or h>dw>e vuln]ability1 = :i* !re is reliable evid5ce ( a successful exploitation ( ! vuln]ability by an actor )\t au?orization ( ! ,f$]al in=mation sy/em own]2 or 7,d7 ! contractor or aw>dee has receiv$ f ! ag5cy p]sonally id5tifiable in=mation or p]sonal heal? in=mation t is beyond ! scope ( ! contract or agreem5t ) ! ag5cy t ! contractor or aw>dee is n au?oriz$ to receive4 7#b7 ,?ird-p>ty notification ( vuln]abilities ,subject to ! guidance issu$ by ! ,director pursuant to p>agraph 7#d71 any contractor or aw>dee ( an ag5cy %all provide writt5 notification to ! ag5cy & ! ,cyb]security & ,infra/ructure ,security ,ag5cy if ! contractor or aw>dee has a reasonable basis to conclude t a compon5t ( any ,f$]al in=mation sy/em op]at$1 manag$1 or ma9ta9$ on behalf ( an ag5cy by ! contractor or aw>dee on behalf ( ! ag5cy conta9s a security vuln]ability1 includ+ a supply *a9 compromise or an id5tifi$ s(tw>e or h>dw>e vuln]ability1 t has be5 report$ to ! contractor or aw>dee by a ?ird p>ty1 includ+ ?r\gh a vuln]ability disclosure program4 7#c7 ,proc$ures 7,a7 ,%>+ ) ,,cisa ,z soon z practicable foll[+ a notification ( an incid5t or vuln]ability to an ag5cy by a contractor or aw>dee "u p>agraph 7#a71 ! head ( ! ag5cy %all provide1 pursuant to section #ceid1 in=mation ab\t ! incid5t or vuln]ability to ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7,b7 ,tim+ ( notifications ,unless a diff]5t "t = notification is specifi$ 9 a contract1 grant1 coop]ative agreem5t1 or o!r transaction agreem5t1 a contractor or aw>dee %all-- 7i7 make a notification requir$ "u p>agraph 7#a7 n lat] ?an #a day aft] ! date on :i* ! contractor or aw>dee has reasonable basis to suspect or conclude t ! crit]ia "u p>agraph 7#a7 h be5 met2 & 7ii7 make a notification requir$ "u p>agraph 7#b7 )9 a reasonable "t1 b n lat] ?an #ij days aft] ! date on :i* ! contractor or aw>dee has reasonable basis to suspect or conclude t ! crit]ia "u p>agraph 7#b7 h be5 met4 7,c7 ,proc$ures ,foll[+ a notification ( a brea* or incid5t to an ag5cy by a contractor or aw>dee "u p>agraph 7#a71 ! head ( ! ag5cy1 9 consultation ) ! contractor or aw>dee1 %all c>ry out ! applicable requirem5ts "u sections #ceib1 #ceic1 & #ceid ) respect to ! brea* or incid5t4 7,d7 ,rule ( con/ruction ,no?+ 9 subp>agraph 7,b7 %all be con/ru$ to all[ ! negation ( ! requirem5ts to notify vuln]abilities "u p>agraph 7#a7 or 7#b7 ?r\gh a contract1 grant1 coop]ative agreem5t1 or o!r transaction agreem5t4 7#d7 ,guidance ,! ,director %all issue guidance z soon z practicable to ag5cies relat+ to ! scope ( vuln]abilities to be includ$ 9 requir$ notifications "u p>agraph 7#b71 su* z ! m9imum sev]ity or m9imum risk level ( a vuln]ability includ$ 9 requir$ notifications1 :e!r vuln]abilities t are already publicly disclos$ mu/ be report$1 or likely cyb]security impact to ,f$]al in=mation sy/ems4 7b7 ,regulations2 modifications 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbd-- 7,a7 ! ,f$]al ,acquisition ,regulatory ,c\ncil %all promulgate regulations1 z appropriate1 relat+ to ! responsibilities ( contractors & recipi5ts ( o!r transaction agreem5ts & coop]ative agreem5ts to comply ) ?is section2 & 7,b7 ! ,(fice ( ,f$]al ,f9ancial ,managem5t %all promulgate regulations "u title #b1 ,code ( ,f$]al ,regulations1 z appropriate1 relat+ to ! responsibilities ( grantees to comply ) ?is section4 7#b7 ,implem5tation ,n lat] ?an #a ye> aft] ! date on :i* ! ,f$]al ,acquisition ,regulatory ,c\ncil & ! ,(fice ( ,f$]al ,f9ancial ,managem5t promulgates regulations "u p>agraph 7#a71 ! head ( ea* ag5cy %all implem5t policies & proc$ures1 z appropriate1 necess>y to implem5t ^? regulations4 7#c7 ,congressional notification 7,a7 ,9 g5]al ,! head ( ea* ag5cy head %all notify ! ,director ^u implem5tation ( policies & proc$ures necess>y to implem5t ! regulations promulgat$ "u p>agraph 7#a74 7,b7 ,,omb notification ,n lat] ?an #cj days aft] ! date describ$ 9 p>agraph 7#b71 ! ,director %all notify ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committees on ,ov]sight & ,acc\ntability & ,homel& ,security ( ! ,h\se ( ,repres5tatives on ! /atus ( ! implem5tation by ea* ag5cy ( ! regulations promulgat$ "u p>agraph 7#a74 7c7 ,all[able use ,in=mation provid$ to an ag5cy pursuant to ?is section may be disclos$ to1 reta9$ by1 & us$ by any ag5cy1 compon5t1 (fic]1 employee1 or ag5t ( ! ,f$]al ,gov]nm5t solely = any ( ! foll[+3 7#a7 ,a cyb]security purpose 7z def9$ 9 section #bbjj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej774 7#b7 ,id5tify+-- 7,a7 a cyb] ?reat 7z def9$ 9 su* section #bbjj71 includ+ ! s\rce ( ! cyb] ?reat2 or 7,b7 a security vuln]ability 7z def9$ 9 su* section #bbjj74 7#c7 ,prev5t+1 inve/igat+1 disrupt+1 or prosecut+ an (f5se aris+ out ( an incid5t notifi$ to an ag5cy pursuant to ?is section or any ( ! (f5ses li/$ 9 section #aje7;d77#e77;,a77v7 ( ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae 7#f ,u4,s4,c4 #aejd7;d77#e77;,a77v774 7d7 ,h>monization ( o!r private-sector cyb]security report+ obligations ,any non-,f$]al entity requir$ to report an incid5t "u section #bbdb ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fha;b7 may submit z "p ( ! writt5 notification requirem5ts 9 ?is section all in=mation requir$ by su* section #bbdb to ! ag5cy ( :i* ! entity is a contractor or recipi5t ( ,f$]al f9ancial assi/ance1 or ) :i* ! entity holds an o!r transaction agreem5t or coop]ative agreem5t1 )9 ! deadl9e specifi$ 9 subsection 7a77#c77;,b77#a74 ,if su* submission is complet$1 ! non-,f$]al entity %all n be requir$ to subsequ5tly report ! same incid5t "u ! requirem5ts ( su* section #bbdb4 ,any incid5t in=mation %>$ "u ?is subsection %all be %>$ ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy pursuant to subsection 7a77#c77;,a74 7e7 ,national security sy/ems exemption ,not)/&+ any o!r provision ( ?is section1 a contractor or aw>dee ( an ag5cy t w\ld be requir$ to report an incid5t or vuln]ability pursuant to ?is section t occurs exclusively on a national security sy/em %all-- 7#a7 report ! incid5t or vuln]ability to ! head ( ! ag5cy & ! ,secret>y ( ,def5se2 & 7#b7 comply ) applicable laws & policies relat+ to national security sy/ems4 #ceif4 ,tra9+ 7a7 ,cov]$ individual def9$ ,9 ?is section1 ! t]m cov]$ individual means an individual :o obta9s access to a ,f$]al in=mation sy/em because ( ! /atus ( ! individual z-- 7#a7 an employee1 contractor1 aw>dee1 volunte]1 or int]n ( an ag5cy2 or 7#b7 an employee ( a contractor or aw>dee ( an ag5cy4 7b7 ,be/ practices & consi/5cy ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 ! ,national ,cyb] ,director1 & ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 %all consolidate be/ practices to support consi/5cy across ag5cies 9 cyb]security incid5t response tra9+1 includ+-- 7#a7 in=mation to be collect$ & %>$ ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy pursuant to section #ceid7;a7 & processes = %>+ su* in=mation2 & 7#b7 appropriate tra9+ & qualifications = cyb] incid5t respond]s4 7c7 ,ag5cy tra9+ ,! head ( ea* ag5cy %all develop tra9+ = cov]$ individuals on h[ to id5tify & respond to an incid5t1 includ+-- 7#a7 ! int]nal process ( ! ag5cy = report+ an incid5t2 & 7#b7 ! obligation ( a cov]$ individual to report to ! ag5cy any suspect$ or confirm$ incid5t involv+ ,f$]al in=mation 9 any m$ium or =m1 includ+ pap]1 oral1 & electronic4 7d7 ,inclusion 9 annual tra9+ ,! tra9+ develop$ "u subsection 7c7 may be includ$ z "p ( an annual privacy1 security aw>5ess1 or o!r appropriate tra9+ ( an ag5cy4 #ceig4 ,analysis & report on ,f$]al incid5ts 7a7 ,analysis ( ,f$]al incid5ts 7#a7 ,quantitative & qualitative analyses ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all p]=m &1 9 coord9ation ) ! ,director & ! ,national ,cyb] ,director1 develop1 cont9u\s monitor+ & quantitative & qualitative analyses ( incid5ts at ag5cies1 includ+ major incid5ts1 includ+-- 7,a7 ! causes ( incid5ts1 includ+-- 7i7 attack] tactics1 te*niques1 & proc$ures2 & 7ii7 sy/em vuln]abilities1 includ+ z]o days1 unpat*$ sy/ems1 & in=mation sy/em misconfigurations2 7,b7 ! scope & scale ( incid5ts at ag5cies2 7,c7 common root causes ( incid5ts across multiple ag5cies2 7,d7 ag5cy incid5t response1 recov]y1 & rem$iation actions & ! effectiv5ess ( ^? actions1 z applicable2 7,e7 lessons le>n$ & recomm5dations 9 respond+ to1 recov]+ f1 rem$iat+1 & mitigat+ future incid5ts2 & 7,f7 tr5ds across multiple ag5cies to address intrusion detection & incid5t response capabilities us+ ! metrics e/abli%$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c774 7#b7 ,automat$ analysis ,! analyses develop$ "u p>agraph 7#a7 %all1 to ! greate/ ext5t practicable1 use ma*9e-readable data1 automation1 & ma*9e le>n+ processes4 7#c7 ,%>+ ( data & analysis 7,a7 ,9 g5]al ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all %>e on an ongo+ basis ! analyses & und]ly+ data requir$ "u ?is subsection ) ag5cies1 ! ,director1 & ! ,national ,cyb] ,director to-- 7i7 improve ! und]/&+ ( cyb]security risk ( ag5cies2 & 7ii7 support ! cyb]security improvem5t ef=ts ( ag5cies4 7,b7 ,=mat ,9 c>ry+ out subp>agraph 7,a71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all %>e ! analyses-- 7i7 9 human-readable writt5 products2 & 7ii7 to ! greate/ ext5t practicable1 9 ma*9e-readable =mats 9 ord] to enable automat$ intake & use by ag5cies4 7,c7 ,exemption ,?is subsection %all n apply to incid5ts t occur exclusively on national security sy/ems4 7b7 ,annual report on ,f$]al incid5ts ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is section1 & n less frequ5tly ?an annually !reaft]1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 ! ,national ,cyb] ,director & ! heads ( o!r ag5cies1 z appropriate1 %all submit to ! appropriate report+ entities a report t includes-- 7#a7 a summ>y ( causes ( incid5ts f across ! ,f$]al ,gov]nm5t t categorizes ^? incid5ts z incid5ts or major incid5ts2 7#b7 ! quantitative & qualitative analyses ( incid5ts develop$ "u subsection 7a77#a7 on an ag5cy-by-ag5cy basis & compreh5sively across ! ,f$]al ,gov]nm5t1 includ+-- 7,a7 a specific analysis ( brea*es2 & 7,b7 an analysis ( ! ,f$]al ,gov]nm5t's p]=mance aga9/ ! metrics e/abli%$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c772 & 7#c7 an annex = ea* ag5cy t includes-- 7,a7 a description ( ea* major incid5t2 7,b7 ! total numb] ( incid5ts ( ! ag5cy2 & 7,c7 an analysis ( ! ag5cy's p]=mance aga9/ ! metrics e/abli%$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c774 7c7 ,publication 7#a7 ,9 g5]al ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all make a v]sion ( ea* report submitt$ "u subsection 7b7 publicly available on ! website ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy dur+ ! ye> dur+ :i* ! report is submitt$4 7#b7 ,exemption ,! publication requirem5t "u p>agraph 7#a7 %all n apply to a portion ( a report t conta9s cont5t t %\ld be protect$ 9 ! int]e/ ( national security1 z det]m9$ by ! ,director1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 or ! ,national ,cyb] ,director4 7#c7 ,limitation on exemption ,! exemption "u p>agraph 7#b7 %all n apply to any v]sion ( a report submitt$ to ! appropriate report+ entities "u subsection 7b74 7#d7 ,requirem5t = compil+ in=mation 7,a7 ,compilation ,subject to subp>agraph 7,b71 9 mak+ a report publicly available "u p>agraph 7#a71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all suffici5tly compile in=mation s t no specific incid5t ( an ag5cy c be id5tifi$4 7,b7 ,exception ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy may include in=mation t enables a specific incid5t ( an ag5cy to be id5tifi$ 9 a publicly available report-- 7i7 ) ! concurr5ce ( ! ,director & ! ,national ,cyb] ,director2 7ii7 9 consultation ) ! impact$ ag5cy1 :i* may1 z appropriate1 consult ) any non-,f$]al entity impact$ by or support+ ! rem$iation ( su* incid5t2 & 7iii7 9 consultation ) ! inspector g5]al ( ! impact$ ag5cy4 7d7 ,in=mation provid$ by ag5cies 7#a7 ,9 g5]al ,! analysis requir$ "u subsection 7a7 & ea* report submitt$ "u subsection 7b7 %all use in=mation provid$ by ag5cies "u section #ceid7;a74 7#b7 ,noncompliance reports ,dur+ any ye> dur+ :i* ! head ( an ag5cy does n provide data = an incid5t to ! ,cyb]security & ,infra/ructure ,security ,ag5cy 9 accordance ) section #ceid7;a71 ! head ( ! ag5cy1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,director1 %all submit to ! appropriate report+ entities a report t includes ! in=mation describ$ 9 subsection 7b7 ) respect to ! ag5cy4 7e7 ,national security sy/em reports 7#a7 ,9 g5]al ,not)/&+ any o!r provision ( ?is section1 ! ,secret>y ( ,def5se1 9 consultation ) ! ,director1 ! ,national ,cyb] ,director1 ! ,director ( ,national ,intellig5ce1 & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all annually submit a report t includes ! in=mation describ$ 9 subsection 7b7 ) respect to national security sy/ems1 to ! ext5t t ! submission is consi/5t ) /&>ds & guidel9es = national security sy/ems issu$ 9 accordance ) law & z direct$ by ! ,presid5t1 to-- 7,a7 ! majority & m9ority lead]s ( ! ,s5ate2 7,b7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7,c7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,d7 ! ,select ,committee on ,intellig5ce ( ! ,s5ate2 7,e7 ! ,committee on ,arm$ ,s]vices ( ! ,s5ate2 7,f7 ! ,committee on ,appropriations ( ! ,s5ate2 7,g7 ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives2 7,h7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives2 7,i7 ! ,p]man5t ,select ,committee on ,intellig5ce ( ! ,h\se ( ,repres5tatives2 7,j7 ! ,committee on ,arm$ ,s]vices ( ! ,h\se ( ,repres5tatives2 & 7,k7 ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives4 7#b7 ,classifi$ =m ,a report requir$ "u p>agraph 7#a7 may be submitt$ 9 a classifi$ =m4 #ceih4 ,major incid5t def9ition 7a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! lat] ( ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbd & ! mo/ rec5t publication by ! ,director ( guidance to ag5cies reg>d+ major incid5ts z ( ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbd1 ! ,director %all develop1 9 coord9ation ) ! ,national ,cyb] ,director1 & promulgate guidance on ! def9ition ( ! t]m major incid5t = ! purposes ( sub*apt] ,,ii & ?is sub*apt]4 7b7 ,requirem5ts ,) respect to ! guidance issu$ "u subsection 7a71 ! def9ition ( ! t]m major incid5t %all-- 7#a7 include1 ) respect to any in=mation collect$ or ma9ta9$ by or on behalf ( an ag5cy or a ,f$]al in=mation sy/em-- 7,a7 any incid5t ! head ( ! ag5cy det]m9es is likely to result 9 demon/rable h>m to-- 7i7 ! national security int]e/s1 =eign relations1 homel& security1 or economic security ( ! ,unit$ ,/ates2 or 7ii7 ! civil lib]ties1 public confid5ce1 privacy1 or public heal? & safety ( ! p ( ! ,unit$ ,/ates2 7,b7 any incid5t ! head ( ! ag5cy det]m9es likely to result 9 an inability or sub/antial disruption = ! ag5cy1 a compon5t ( ! ag5cy1 or ! ,f$]al ,gov]nm5t1 to provide #a or m critical s]vices2 7,c7 any incid5t ! head ( ! ag5cy det]m9es sub/antially disrupts or sub/antially degrades ! op]ations ( a high value asset own$ or op]at$ by ! ag5cy2 7,d7 any incid5t involv+ ! exposure to a =eign entity ( s5sitive ag5cy in=mation1 su* z ! communications ( ! head ( ! ag5cy1 ! head ( a compon5t ( ! ag5cy1 or ! direct reports ( ! head ( ! ag5cy or ! head ( a compon5t ( ! ag5cy2 & 7,e7 any o!r type ( incid5t det]m9$ appropriate by ! ,director2 7#b7 /ipulate t ! ,national ,cyb] ,director1 9 consultation ) ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 may decl>e a major incid5t at any ag5cy1 & su* a decl>ation %all be consid]$ if x is det]m9$ t an incid5t-- 7,a7 occurs at n less ?an #b ag5cies2 & 7,b7 is enabl$ by-- 7i7 a common te*nical root cause1 su* z a supply *a9 compromise1 or a common s(tw>e or h>dw>e vuln]ability2 or 7ii7 ! relat$ activities ( a common ?reat actor2 7#c7 /ipulate t1 9 det]m9+ :e!r an incid5t con/itutes a major incid5t "u ! /&>ds describ$ 9 p>agraph 7#a71 ! head ( ! ag5cy %all consult ) ! ,national ,cyb] ,director2 & 7#d7 /ipulate t ! m]e report ( a vuln]ability discov]$ or disclos$ )\t a loss ( confid5tiality1 integrity1 or availability %all n on its own con/itute a major incid5t4 7c7 ,evaluation & updates ,n lat] ?an #fj days aft] ! date on :i* ! ,director fir/ promulgates ! guidance requir$ "u subsection 7a71 & n less frequ5tly ?an once dur+ ! fir/ #ij days ( ea* ev5ly numb]$ ,congress !reaft]1 ! ,director %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committees on ,ov]sight & ,acc\ntability & ,homel& ,security ( ! ,h\se ( ,repres5tatives a brief+ t includes-- 7#a7 an evaluation ( any necess>y updates to ! guidance2 7#b7 an evaluation ( any necess>y updates to ! def9ition ( ! t]m major incid5t includ$ 9 ! guidance2 & 7#c7 an explanation (1 & ! analysis t l$ to1 ! def9ition describ$ 9 p>agraph 7#b74 4 7#b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 ,,sub*apt] ,,iv--,f$]al sy/em incid5t response #ceia4 ,def9itions4 #ceib4 ,notification ( brea*4 #ceic4 ,congressional & executive bran* reports on major incid5ts4#ceid4 ,gov]nm5t in=mation %>+ & incid5t response4 #ceie4 ,responsibilities ( contractors & aw>dees4 #ceif4 ,tra9+4 #ceig4 ,analysis & report on ,f$]al incid5ts4 #ceih4 ,major incid5t def9ition4 4 #d4 ,am5dm5ts to subtitle ,,iii ( title #dj 7a7 ,mod]niz+ gov]nm5t te*nology ,subtitle ,g ( title ,x ( division ,a ( ! ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjah 7#dj ,u4,s4,c4 #aacja note7 is am5d$ 9 section #ajgh-- 7#a7 by /rik+ subsection 7a7 & ins]t+ ! foll[+3 7a7 ,def9itions ,9 ?is section3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #eea ( title #e1 ,unit$ ,/ates ,code4 7#b7 ,high value asset ,! t]m high value asset has ! mean+ giv5 ! t]m 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code4 2 7#b7 9 subsection 7b71 by add+ at ! end ! foll[+3 7#h7 ,proposal evaluation ,! ,director %all-- 7,a7 give consid]ation = ! use ( am\nts 9 ! ,fund to improve ! security ( high value assets2 & 7,b7 require t any proposal = ! use ( am\nts 9 ! ,fund includes1 z appropriate1 & :i* may be incorporat$ into o!rwise requir$ project proposal docum5tation-- 7i7 cyb]security risk managem5t consid]ations2 & 7ii7 a supply *a9 risk assessm5t 9 accordance ) section #acbf ( title #da4 2 & 7#c7 9 subsection 7c7-- 7,a7 9 p>agraph 7#b77;,a77i71 by ins]t+ 1 includ+ a consid]ation ( ! impact on high value assets aft] op]ational risks2 7,b7 9 p>agraph 7#e7-- 7i7 9 subp>agraph 7,a71 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,b71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,c7 a s5ior (ficial f ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 appo9t$ by ! ,director4 2 & 7,c7 9 p>agraph 7#f77;,a71 by /rik+ %all be-- & all t foll[s ?r\gh #d employees & ins]t+ %all be #d employees4 7b7 ,sub*apt] ,i ,sub*apt] ,i ( *apt] #aac ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #aacjb-- 7,a7 9 subsection 7b71 by /rik+ use1 security1 & disposal ( & ins]t+ use1 & disposal (1 &1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 promote & improve ! security (12 & 7,b7 9 subsection 7h71 by ins]t+ 1 includ+ cyb]security p]=mances1 aft] ! p]=mances2 & 7#b7 9 section #aacjc7;b77#b77;,b7-- 7,a7 9 clause 7i71 by /rik+ or at ! end2 7,b7 9 clause 7ii71 by add+ or at ! end2 & 7,c7 by add+ at ! end ! foll[+3 7iii7 :e!r ! function %\ld be p]=m$ by a %>$ s]vice (f]$ by ano!r executive ag5cy2 4 7c7 ,sub*apt] ,,ii ,sub*apt] ,,ii ( *apt] #aac ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #aacab7;a71 by ins]t+ 1 includ+ security risks aft] manag+ ! risks2 7#b7 9 section #aacac7a71 by /rik+ effici5cy & effectiv5ess & ins]t+ effici5cy1 security1 & effectiv5ess2 7#c7 9 section #aacag1 by ins]t+ security1 be=e or s*$ule2 & 7#d7 9 section #aacai7;b77#a71 9 ! p>agraph head+1 by /rik+ cios & ins]t+ *ief in=mation (fic]s4 #e4 ,actions to enhance ,f$]al incid5t transp>5cy 7a7 ,responsibilities ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7,a7 develop a plan = ! developm5t1 us+ sy/ems 9 place on ! date ( enactm5t ( ?is ,act1 ( ! analysis requir$ "u section #ceig7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 & ! report requir$ "u subsection 7b7 ( t section t includes-- 7i7 a description ( any *all5ges ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy anticipates enc\nt]+2 & 7ii7 ! use ( automation & ma*9e-readable =mats = collect+1 compil+1 monitor+1 & analyz+ data2 & 7,b7 provide to ! appropriate congressional committees a brief+ on ! plan develop$ "u subp>agraph 7,a74 7#b7 ,brief+ ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! appropriate congressional committees a brief+ on-- 7,a7 ! execution ( ! plan requir$ "u p>agraph 7#a77;,a72 & 7,b7 ! developm5t ( ! report requir$ "u section #ceig7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7b7 ,responsibilities ( ! director ( ! (fice ( managem5t & budget 7#a7 ,updat+ ,,fisma #bjad ,section #b ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjad 7,public ,law #aac-bhc2 #abh ,/at4 #cjgc7 is am5d$-- 7,a7 by /rik+ subsections 7b7 & 7d72 & 7,b7 by r$esignat+ subsections 7c71 7e71 & 7f7 z subsections 7b71 7c71 & 7d71 respectively4 7#b7 ,incid5t data %>+ 7,a7 ,9 g5]al ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all develop1 & z appropriate update1 guidance1 on ! cont5t1 timel9ess1 & =mat ( ! in=mation provid$ by ag5cies "u section #ceid7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7,b7 ,requirem5ts ,! guidance develop$ "u subp>agraph 7,a7 %all-- 7i7 enable ! effici5t developm5t (-- 7,i7 lessons le>n$ & recomm5dations 9 respond+ to1 recov]+ f1 rem$iat+1 & mitigat+ future incid5ts2 & 7,,ii7 ! report on ,f$]al incid5ts requir$ "u section #ceig7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act2 & 7ii7 include requirem5ts = ! timel9ess ( data production4 7,c7 ,automation ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all promote1 z feasible1 ! use ( automation & ma*9e-readable data = data %>+ "u section #ceid7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7#c7 ,contractor & aw>dee guidance 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all issue guidance to ag5cies on h[ to deconflict1 to ! greate/ ext5t practicable1 exi/+ regulations1 policies1 & proc$ures relat+ to ! responsibilities ( contractors & aw>dees e/abli%$ "u section #ceie ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7,b7 ,exi/+ processes ,to ! greate/ ext5t practicable1 ! guidance issu$ "u subp>agraph 7,a7 %all all[ contractors & aw>dees to use exi/+ processes = notify+ ag5cies ( incid5ts involv+ in=mation ( ! ,f$]al ,gov]nm5t4 7c7 ,update to ! ,privacy act ( #aigd ,section #eeb;a7b7 ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,privacy ,act ( #aigd7 is am5d$-- 7#a7 9 p>agraph 7#aa71 by /rik+ or at ! end2 7#b7 9 p>agraph 7#ab71 by /rik+ ! p]iod at ! end & ins]t+ 2 or2 & 7#c7 by add+ at ! end ! foll[+3 7#ac7 to ano!r ag5cy1 to ! ext5t necess>y1 to assi/ ! recipi5t ag5cy 9 respond+ to an incid5t 7z def9$ 9 section #ceeb ( title #dd7 or brea* 7z def9$ 9 section #ceia ( title #dd7 or to fulfill ! in=mation %>+ requirem5ts "u section #ceid ( title #dd4 4 #f4 ,ag5cy requirem5ts to notify private sector entities impact$ by incid5ts 7a7 ,def9itions ,9 ?is section3 7#a7 ,report+ entity ,! t]m report+ entity means private organization or gov]nm5tal unit t is requir$ by /atute or regulation to submit s5sitive in=mation to an ag5cy4 7#b7 ,s5sitive in=mation ,! t]m s5sitive in=mation has ! mean+ giv5 ! t]m by ! ,director 9 guidance issu$ "u subsection 7b74 7b7 ,guidance on notification ( report+ entities ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all develop1 9 consultation ) ! ,national ,cyb] ,director1 & issue guidance requir+ ! head ( ea* ag5cy to notify a report+ entity 9 an appropriate & timely mann]1 & take into consid]ation ! ne$ to coord9ate ) ,sector ,risk ,managem5t ,ag5cies 7z def9$ 9 section #bbjj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej771 z appropriate1 ( an incid5t at ! ag5cy t is likely to sub/antially affect-- 7#a7 ! confid5tiality or integrity ( s5sitive in=mation submitt$ by ! report+ entity to ! ag5cy pursuant to a /atutory or regulatory requirem5t2 or 7#b7 any in=mation sy/em 7z def9$ 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code7 us$ 9 ! transmission or /orage ( ! s5sitive in=mation describ$ 9 p>agraph 7#a74 #g4 ,f$]al p5etration te/+ policy 7a7 ,9 g5]al ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #ceei;,a4 ,f$]al p5etration te/+ 7a7 ,guidance ,! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance to ag5cies t-- 7#a7 requires ag5cies to p]=m p5etration te/+ on in=mation sy/ems1 z appropriate1 includ+ on high value assets2 7#b7 provides policies gov]n+ ! developm5t (-- 7,a7 rules ( engagem5t = us+ p5etration te/+2 & 7,b7 proc$ures to use ! results ( p5etration te/+ to improve ! cyb]security & risk managem5t ( ! ag5cy2 7#c7 ensures t op]ational support or a %>$ s]vice is available2 & 7#d7 9 no mann] re/ricts ! au?ority ( ! ,secret>y ( ,homel& ,security or ! ,director ( ! ,cyb]security & ,infra/ructure ,ag5cy to conduct ?reat hunt+ pursuant to section #ceec1 or p5etration te/+ "u ?is *apt]4 7b7 ,exception = national security sy/ems ,! guidance issu$ "u subsection 7a7 %all n apply to national security sy/ems4 7c7 ,delegation ( au?ority = c]ta9 sy/ems ,! au?orities ( ! ,director describ$ 9 subsection 7a7 %all be delegat$ to-- 7#a7 ! ,secret>y ( ,def5se 9 ! case ( a sy/em describ$ 9 section #ceec7;e77#b72 & 7#b7 ! ,director ( ,national ,intellig5ce 9 ! case ( a sy/em describ$ 9 section #ceec7;e77#c74 4 7b7 ,exi/+ guidance 7#a7 ,9 g5]al ,compliance ) guidance issu$ by ! ,director relat+ to p5etration te/+ be=e ! date ( enactm5t ( ?is ,act %all be deem$ to be compliant ) section #ceei;,a ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7#b7 ,imm$iate new guidance n requir$ ,no?+ 9 section #ceei;,a ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 %all be con/ru$ to require ! ,director to issue new guidance to ag5cies relat+ to p5etration te/+ be=e ! date describ$ 9 p>agraph 7#c74 7#c7 ,guidance updates ,not)/&+ p>agraphs 7#a7 & 7#b71 n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all review &1 z appropriate1 update exi/+ guidance requir+ p5etration te/+ by ag5cies4 7c7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ aft] ! item relat+ to section #ceei ! foll[+3 #ceei;,a4 ,f$]al p5etration te/+4 4 7d7 ,p5etration te/+ by ! ,secret>y ( ,homel& ,security ,section #ceec7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act1 is fur!r am5d$ by ins]t+ aft] p>agraph 7#h7 ! foll[+3 7#i7 p]=m+ p5etration te/+ t may lev]age manual exp]t analysis to id5tify ?reats & vuln]abilities )9 in=mation sy/ems-- 7,a7 )\t cons5t or au?orization f ag5cies2 & 7,b7 ) prior consultation ) ! head ( ! ag5cy at lea/ #gb h\rs 9 advance ( su* te/+2 4 #h4 ,vuln]ability disclosure policies 7a7 ,9 g5]al ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] section #ceei;,a1 z add$ by ?is ,act1 ! foll[+3 #ceei;,b4 ,f$]al vuln]ability disclosure policies 7a7 ,purpose2 s5se ( ,congress 7#a7 ,purpose ,! purpose ( ,f$]al vuln]ability disclosure policies is to create a me*anism to enable ! public to in=m ag5cies ( vuln]abilities 9 ,f$]al in=mation sy/ems4 7#b7 ,s5se ( ,congress ,x is ! s5se ( ,congress t1 9 implem5t+ ! requirem5ts ( ?is section1 ! ,f$]al ,gov]nm5t %\ld take appropriate /eps to r$uce real & p]ceiv$ burd5s 9 communications betwe5 ag5cies & security rese>*]s4 7b7 ,def9itions ,9 ?is section3 7#a7 ,contractor ,! t]m contractor has ! mean+ giv5 ! t]m 9 section #ceia4 7#b7 ,int]net ( ?+s ,! t]m int]net ( ?+s has ! mean+ giv5 ! t]m 9 ,special ,publication #hjj-bac ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 entitl$ ,io,t ,device ,cyb]security ,guidance = ! ,f$]al ,gov]nm5t3 ,e/abli%+ ,io,t ,device ,cyb]security ,requirem5ts1 or any successor docum5t4 7#c7 ,security vuln]ability ,! t]m security vuln]ability has ! mean+ giv5 ! t]m 9 section #ajb ( ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae 7#f ,u4,s4,c4 #aeja74 7#d7 ,submitt] ,! t]m submitt] means an individual t submits a vuln]ability disclosure report pursuant to ! vuln]ability disclosure process ( an ag5cy4 7#e7 ,vuln]ability disclosure report ,! t]m vuln]ability disclosure report means a disclosure ( a security vuln]ability made to an ag5cy by a submitt]4 7c7 ,guidance ,! ,director %all issue guidance to ag5cies t includes-- 7#a7 use ( ! in=mation sy/em security vuln]abilities disclosure process guidel9es e/abli%$ "u section #d7;a77#a7 ( ! ,io,t ,cyb]security ,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;b7a77#a772 7#b7 direction to n recomm5d or pursue legal action aga9/ a submitt] or an individual t conducts a security rese>* activity t-- 7,a7 repres5ts a good fai? ef=t to id5tify & report security vuln]abilities 9 in=mation sy/ems2 or 7,b7 o!rwise repres5ts a good fai? ef=t to foll[ ! vuln]ability disclosure policy ( ! ag5cy develop$ "u subsection 7f77#b72 7#c7 direction on %>+ relevant in=mation 9 a consi/5t1 automat$1 & ma*9e-readable mann] ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7#d7 ! m9imum scope ( ag5cy sy/ems requir$ to be cov]$ by ! vuln]ability disclosure policy ( an ag5cy requir$ "u subsection 7f77#b71 includ+ exemptions "u subsection 7g72 7#e7 requirem5ts = provid+ in=mation to ! submitt] ( a vuln]ability disclosure report on ! resolution ( ! vuln]ability disclosure report2 7#f7 a /ipulation t ! m]e id5tification by a submitt] ( a security vuln]ability1 )\t a significant compromise ( confid5tiality1 integrity1 or availability1 does n con/itute a major incid5t2 & 7#g7 ! applicability ( ! guidance to int]net ( ?+s devices own$ or controll$ by an ag5cy4 7d7 ,consultation ,9 develop+ ! guidance requir$ "u subsection 7c77#c71 ! ,director %all consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7e7 ,responsibilities ( ,,cisa ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7#a7 provide support to ag5cies ) respect to ! implem5tation ( ! requirem5ts ( ?is section2 7#b7 develop tools1 processes1 & o!r me*anisms det]m9$ appropriate to (f] ag5cies capabilities to implem5t ! requirem5ts ( ?is section2 7#c7 ^u a reque/ by an ag5cy1 assi/ ! ag5cy 9 ! disclosure to v5dors ( newly id5tifi$ security vuln]abilities 9 v5dor products & s]vices2 & 7#d7 z appropriate1 implem5t ! requirem5ts ( ?is section1 9 accordance ) ! au?ority "u section #ceec7;b77#h71 z a %>$ s]vice available to ag5cies4 7f7 ,responsibilities ( ag5cies 7#a7 ,public in=mation ,! head ( ea* ag5cy %all make publicly available1 ) respect to ea* int]net doma9 "u ! control ( ! ag5cy t is n a national security sy/em & to ! ext5t consi/5t ) ! security ( in=mation sy/ems b ) ! presumption ( disclosure-- 7,a7 an appropriate security contact2 & 7,b7 ! compon5t ( ! ag5cy t is responsible = ! int]net accessible s]vices (f]$ at ! doma94 7#b7 ,vuln]ability disclosure policy ,! head ( ea* ag5cy %all develop & make publicly available a vuln]ability disclosure policy = ! ag5cy1 :i* %all-- 7,a7 describe-- 7i7 ! scope ( ! sy/ems ( ! ag5cy includ$ 9 ! vuln]ability disclosure policy1 includ+ = int]net ( ?+s devices own$ or controll$ by ! ag5cy2 7ii7 ! type ( in=mation sy/em te/+ t is au?oriz$ by ! ag5cy2 7iii7 ! type ( in=mation sy/em te/+ t is n au?oriz$ by ! ag5cy2 7iv7 ! disclosure policy = a contractor2 & 7v7 ! disclosure policy ( ! ag5cy = s5sitive in=mation2 7,b7 ) respect to a vuln]ability disclosure report to an ag5cy1 describe-- 7i7 h[ ! submitt] %\ld submit ! vuln]ability disclosure report2 & 7ii7 if ! report is n anonym\s1 :5 ! report] %\ld anticipate an ackn[l$gm5t ( receipt ( ! report by ! ag5cy2 7,c7 include any o!r relevant in=mation2 & 7,d7 be mature 9 scope & cov] e int]net accessible in=mation sy/em us$ or op]at$ by t ag5cy or on behalf ( t ag5cy4 7#c7 ,id5tifi$ security vuln]abilities ,! head ( ea* ag5cy %all-- 7,a7 consid] security vuln]abilities report$ 9 accordance ) p>agraph 7#b72 7,b7 comm5surate ) ! risk pos$ by ! security vuln]ability1 address su* security vuln]ability us+ ! security vuln]ability managem5t process ( ! ag5cy2 & 7,c7 9 accordance ) subsection 7c77#e71 provide in=mation to ! submitt] ( a vuln]ability disclosure report4 7g7 ,exemptions 7#a7 ,9 g5]al ,! ,director & ! head ( ea* ag5cy %all c>ry out ?is section 9 a mann] consi/5t ) ! protection ( national security in=mation4 7#b7 ,limitation ,! ,director & ! head ( ea* ag5cy may n publi% "u subsection 7f77#a7 or include 9 a vuln]ability disclosure policy "u subsection 7f77#b7 ho/ names1 s]vices1 in=mation sy/ems1 or o!r in=mation t ! ,director or ! head ( an ag5cy1 9 coord9ation ) ! ,director & o!r appropriate heads ( ag5cies1 det]m9es w\ld-- 7,a7 disrupt a law en=cem5t inve/igation2 7,b7 endang] national security or intellig5ce activities2 or 7,c7 imp$e national def5se activities or milit>y op]ations4 7#c7 ,national security sy/ems ,?is section %all n apply to national security sy/ems4 7h7 ,delegation ( au?ority = c]ta9 sy/ems ,! au?orities ( ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy describ$ 9 ?is section %all be delegat$-- 7#a7 to ! ,secret>y ( ,def5se 9 ! case ( sy/ems describ$ 9 section #ceec7;e77#b72 & 7#b7 to ! ,director ( ,national ,intellig5ce 9 ! case ( sy/ems describ$ 9 section #ceec7;e77#c74 7i7 ,revision ( ,f$]al acquisition regulation ,! ,f$]al ,acquisition ,regulation %all be revis$ z necess>y to implem5t ! provisions "u ?is section4 4 7b7 ,exi/+ guidance & policies 7#a7 ,9 g5]al ,compliance ) guidance issu$ by ! ,director relat+ to vuln]ability disclosure policies be=e ! date ( enactm5t ( ?is ,act %all be deem$ to be compliance ) section #ceei;,b ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title4 7#b7 ,imm$iate new guidance n requir$ ,no?+ 9 section #ceei;,b ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title1 %all be con/ru$ to require ! ,director to issue new guidance to ag5cies relat+ to vuln]ability disclosure policies be=e ! date describ$ 9 p>agraph 7#d74 7#c7 ,imm$iate new policies n requir$ ,no?+ 9 section #ceei;,b ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title1 %all be con/ru$ to require ! head ( any ag5cy to issue new policies relat+ to vuln]ability disclosure policies be=e ! issuance ( any updat$ guidance "u p>agraph 7#d74 7#d7 ,guidance update ,not)/&+ p>agraphs 7#a71 7#b7 & 7#c71 n lat] ?an #d ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all review &1 z appropriate1 update exi/+ guidance relat+ to vuln]ability disclosure policies4 7c7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ aft] ! item relat+ to section #ceei;,a1 z add$ by ?is ,act1 ! foll[+3 #ceei;,b4 ,f$]al vuln]ability disclosure policies4 4 7d7 ,con=m+ update & repeal 7#a7 ,guidel9es on ! disclosure process = security vuln]abilities relat+ to in=mation sy/ems1 includ+ int]net ( ?+s devices ,section #e ( ! ,io,t ,cyb]security ,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c7 is am5d$ by /rik+ subsections 7d7 & 7e74 7#b7 ,implem5tation & contractor compliance ,! ,io,t ,cyb]security ,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a et seq47 is am5d$-- 7,a7 by /rik+ section #f 7#ae ,u4,s4,c4 #bgh;g-#c;d72 & 7,b7 by /rik+ section #g 7#ae ,u4,s4,c4 #bgh;g-#c;e74 #i4 ,implem5t+ z]o tru/ ar*itecture 7a7 ,brief+s ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committees on ,ov]sight & ,acc\ntability & ,homel& ,security ( ! ,h\se ( ,repres5tatives a brief+ on progress 9 increas+ ! int]nal def5ses ( ag5cy sy/ems1 includ+-- 7#a7 %ift+ away f tru/$ networks to implem5t security controls bas$ on a presumption ( compromise1 includ+ ?r\gh ! transition to z]o tru/ ar*itecture2 7#b7 implem5t+ pr9ciples ( lea/ privilege 9 adm9i/]+ in=mation security programs2 7#c7 limit+ ! ability ( entities t cause incid5ts to move lat]ally ?r\gh or betwe5 ag5cy sy/ems2 7#d7 id5tify+ incid5ts quickly2 7#e7 isolat+ & remov+ unau?oriz$ entities f ag5cy sy/ems z quickly z practicable1 acc\nt+ = intellig5ce or law en=cem5t purposes2 & 7#f7 o!rwise increas+ ! res\rce co/s = entities t cause incid5ts to be successful4 7b7 ,progress report ,z a "p ( ea* report requir$ to be submitt$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code1 dur+ ! p]iod beg9n+ on ! date t is #d ye>s aft] ! date ( enactm5t ( ?is ,act & end+ on ! date t is #aj ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all include an update on ag5cy implem5tation ( z]o tru/ ar*itecture1 :i* %all include-- 7#a7 a description ( /eps ag5cies h complet$1 includ+ progress t[>d a*iev+ any requirem5ts issu$ by ! ,director1 includ+ ! adoption ( any models or ref]5ce ar*itecture2 7#b7 an id5tification ( activities t h n yet be5 complet$ & t w\ld h ! mo/ imm$iate security impact2 & 7#c7 a s*$ule to implem5t any plann$ activities4 7c7 ,classifi$ annex ,ea* update requir$ "u subsection 7b7 may include #a or m annexes t conta9 classifi$ or o!r s5sitive in=mation1 z appropriate4 7d7 ,national security sy/ems 7#a7 ,brief+ ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,def5se %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 ! ,committee on ,ov]sight & ,acc\ntability ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,arm$ ,s]vices ( ! ,s5ate1 ! ,committee on ,arm$ ,s]vices ( ! ,h\se ( ,repres5tatives1 ! ,select ,committee on ,intellig5ce ( ! ,s5ate1 & ! ,p]man5t ,select ,committee on ,intellig5ce ( ! ,h\se ( ,repres5tatives a brief+ on ! implem5tation ( z]o tru/ ar*itecture ) respect to national security sy/ems4 7#b7 ,progress report ,n lat] ?an ! date on :i* ea* update is requir$ to be submitt$ "u subsection 7b71 ! ,secret>y ( ,def5se %all submit to ! congressional committees describ$ 9 p>agraph 7#a7 a progress report on ! implem5tation ( z]o tru/ ar*itecture ) respect to national security sy/ems4 #aj4 ,automation & artificial intellig5ce 7a7 ,def9ition ,9 ?is section1 ! t]m in=mation sy/em has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7b7 ,use ( artificial intellig5ce 7#a7 ,9 g5]al ,z appropriate1 ! ,director %all issue guidance on ! use ( artificial intellig5ce by ag5cies to improve ! cyb]security ( in=mation sy/ems4 7#b7 ,consid]ations ,! ,director & head ( ea* ag5cy %all consid] ! use & capabilities ( artificial intellig5ce sy/ems 9 fur!rance ( ! cyb]security ( in=mation sy/ems4 7#c7 ,report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft] until ! date t is #e ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all submit to ! appropriate congressional committees a report on ! use ( artificial intellig5ce to fur!r ! cyb]security ( in=mation sy/ems4 7c7 ,comptroll] g5]al reports 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! appropriate congressional committees a report on ! risks to ! privacy ( individuals & ! cyb]security ( in=mation sy/ems associat$ ) ! use by ,f$]al ag5cies ( artificial intellig5ce sy/ems or capabilities4 7#b7 ,/udy ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all p]=m a /udy1 & submit to ! ,committees on ,homel& ,security & ,gov]nm5tal ,affairs & ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committees on ,ov]sight & ,acc\ntability1 ,homel& ,security1 & ,sci5ce1 ,space1 & ,te*nology ( ! ,h\se ( ,repres5tatives a report1 on ! use ( automation1 artificial intellig5ce1 includ+ g5]ative artificial intellig5ce1 & ma*9e-readable data across ! ,f$]al ,gov]nm5t = cyb]security purposes1 includ+-- 7,a7 ! automat$ updat+ ( cyb]security tools1 s5sors1 or processes employ$ by ag5cies "u p>agraphs 7#a71 7#e77;,c71 & 7#h77;,b7 ( section #ceed7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act2 & 7,b7 to combat social eng9e]+ attacks4 #aa4 ,f$]al cyb]security requirem5ts 7a7 ,codify+ ,f$]al cyb]security requirem5ts 9 title #dd 7#a7 ,am5dm5t to ,f$]al ,cyb]security ,enhancem5t ,act ( #bjae ,section #bbe ( ! ,f$]al ,cyb]security ,enhancem5t ,act ( #bjae 7#f ,u4,s4,c4 #aebc7 is am5d$ by /rik+ subsections 7b7 & 7c74 7#b7 ,title #dd ,section #ceed ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act1 is fur!r am5d$ by add+ at ! end ! foll[+3 7f7 ,specific cyb]security requirem5ts at ag5cies 7#a7 ,9 g5]al ,consi/5t ) policies1 /&>ds1 guidel9es1 & directives on in=mation security "u ?is sub*apt]1 & except z provid$ "u p>agraph 7#c71 ! head ( ea* ag5cy %all-- 7,a7 id5tify s5sitive & mission critical data /or$ by ! ag5cy consi/5t ) ! inv5tory requir$ "u section #ceje7;c72 7,b7 assess access controls to ! data describ$ 9 subp>agraph 7,a71 ! ne$ = readily accessible /orage ( ! data1 & ! ne$ ( individuals to access ! data2 7,c7 encrypt or o!rwise r5d] indeciph]able to unau?oriz$ us]s ! data describ$ 9 subp>agraph 7,a7 t is /or$ on or transit+ ag5cy in=mation sy/ems2 7,d7 implem5t id5tity & access managem5t sy/ems to ensure ! security ( ,f$]al in=mation sy/ems & protect ag5cy records & data f fraud result+ f ! misrepres5tation ( id5tity or id5tity !ft1 includ+-- 7i7 a s+le sign-on tru/$ id5tity plat=m = individuals access+ ea* public website ( ! ag5cy t requires1 at a m9imum1 us] au!ntication & v]ification s]vices consi/5t ) applicable law & guidance issu$ by ! ,director ( ! ,(fice ( ,managem5t & ,budget :o %all consid] any applicable /&>d or guidel9e develop$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology1 :i* may be "o develop$ by ! ,adm9i/rator ( ,g5]al ,s]vices 9 consultation ) ! ,director ( ! ,(fice ( ,managem5t & ,budget2 & 7ii7 multi-factor au!ntication1 consi/5t ) guidance issu$ by ! ,director ( ! ,(fice ( ,managem5t & ,budget :o %all consid] any applicable /&>d or guidel9e develop$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology1 =-- 7,i7 remote access to an in=mation sy/em2 & 7,,ii7 ea* us] acc\nt ) elevat$ privileges on an in=mation sy/em4 7#b7 ,prohibition 7,a7 ,def9ition ,9 ?is p>agraph1 ! t]m int]net ( ?+s has ! mean+ giv5 ! t]m 9 section #ceei;,b4 7,b7 ,prohibition ,consi/5t ) policies1 /&>ds1 guidel9es1 & directives on in=mation security "u ?is sub*apt]1 & except z provid$ "u p>agraph 7#c71 ! head ( an ag5cy may n procure1 obta91 r5ew a contract to procure or obta9 9 any am\nt1 not)/&+ section #aije ( title #da1 or use an int]net ( ?+s device if ! ,*ief ,in=mation ,(fic] ( ! ag5cy det]m9es dur+ a review requir$ "u section #aacai7;b77#a77;,c7 ( title #dj ( a contract = an int]net ( ?+s device t ! use ( ! device prev5ts compliance ) ! /&>ds & guidel9es develop$ "u section #d ( ! ,io,t ,cyb]security ,improvem5t ,act 7#ae ,u4,s4,c4 #bgh;g-#c;b7 ) respect to ! device4 7#c7 ,exceptions 7,a7 ,9 g5]al ,! requirem5ts "u subp>agraphs 7,a71 7,b71 7,c71 & 7,d77ii7 ( p>agraph 7#a7 %all n apply to an in=mation sy/em = :i* ! head ( ! ag5cy1 )\t delegation1 has-- 7i7 c]tifi$ to ! ,director ) p>ticul>ity t-- 7,i7 op]ational requirem5ts articulat$ 9 ! c]tification & relat$ to ! in=mation sy/em w\ld make x excessively burd5some to implem5t ! cyb]security requirem5t2 7,,ii7 ! cyb]security requirem5t is n necess>y to secure ! in=mation sy/em or ag5cy in=mation /or$ on or transit+ x2 & 7,,iii7 ! ag5cy has tak5 all necess>y /eps to secure ! in=mation sy/em & ag5cy in=mation /or$ on or transit+ x2 & 7ii7 submitt$ ! c]tification describ$ 9 clause 7i7 to ! appropriate congressional committees & ! au?oriz+ committees ( ! ag5cy4 7,b7 ,id5tity managem5t plat=m waiv] ,! head ( an ag5cy %all be 9 compliance ) ! requirem5t "u p>agraph 7#a77;,d77i7 ) respect to implem5t+ a s+le-sign on tru/$ id5tity sy/em or plat=m o!r ?an "o develop$ by ! ,adm9i/rator ( ,g5]al ,s]vices z describ$ "u p>agraph 7#a77;,d77i7 if ! head ( ! ag5cy-- 7i7 )\t delegation-- 7,i7 has c]tifi$ to ! ,director t ! alt]native sy/em or plat=m1 includ+ a procur$ sy/em or plat=m1 con=ms ) applicable security & privacy requirem5ts ( ?is sub*apt] & guidance issu$ by ! ,director1 at lea/ #cj days be=e use ( ! sy/em or plat=m2 or 7,,ii7 ) reg>d to a sy/em or plat=m 9 use z ( ! date ( enactm5t ( ?is subsection1 ! head ( ! ag5cy provides su* c]tification to ! ,director )9 #fj days aft] ! date ( enactm5t ( ?is subsection2 7ii7 has receiv$ a writt5 waiv] f ! ,director 9 response to ! reque/ submitt$ "u clause 7i72 & 7iii7 has submitt$ ! c]tification describ$ 9 clause 7i7 & ! waiv] describ$ clause 7ii7 to ! appropriate congressional committees & ! au?oriz+ committees ( ! ag5cy4 7#d7 ,duration ( c]tification 7,a7 ,9 g5]al ,a c]tification & correspond+ exemption ( an ag5cy "u p>agraph 7#c7 %all expire on ! date t is #d ye>s aft] ! date on :i* ! head ( ! ag5cy submits ! c]tification "u p>agraph 7#c74 7,b7 ,r5ewal ,^u ! expiration ( a c]tification ( an ag5cy "u p>agraph 7#c71 ! head ( ! ag5cy may submit an additional c]tification 9 accordance ) t p>agraph4 7#e7 ,presumption ( adequacy ,a ,fed,r,a,m,p au?orization issu$ pursuant to *apt] #cf ( title #dd %all be presum$ adequate to fulfill ! requirem5ts "u subp>agraphs 7,a7 ?r\gh 7,c7 ( p>agraph 7#a7 ) respect to an ag5cy au?orization to op]ate cl\d comput+ products & s]vices if su* presumption ( adequacy does n alt] or modify-- 7,a7 ! responsibility ( any ag5cy to ensure compliance ) ?is sub*apt] = any cl\d comput+ product or s]vice us$ by ! ag5cy2 or 7,b7 ! au?ority ( ! head ( any ag5cy to make a det]m9ation t !re is a demon/rable ne$ to include additional security controls beyond ^? includ$ 9 a ,fed,r,a,m,p au?orization package = a p>ticul> cl\d comput+ product or s]vice4 7#f7 ,rules ( con/ruction ,no?+ 9 ?is subsection %all be con/ru$-- 7,a7 to alt] ! au?ority ( ! ,secret>y1 ! ,director1 or ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology 9 implem5t+ sub*apt] ,,ii ( ?is title2 7,b7 to affect ! /&>ds or process ( ! ,national ,in/itute ( ,/&>ds & ,te*nology2 7,c7 to affect ! requirem5t "u section #ceec7;a77#d72 7,d7 to disc\rage cont9u$ improvem5ts & advancem5ts 9 ! te*nology1 /&>ds1 policies1 & guidel9es us$ to promote ,f$]al in=mation security2 or 7,e7 to affect ! requirem5ts "u sub*apt] ,,iii4 7g7 ,exception 7#a7 ,national security sy/em requirem5ts ,! requirem5ts "u subsection 7f77#a7 %all n apply to-- 7,a7 a national security sy/em2 or 7,b7 an in=mation sy/em describ$ 9 p>agraph 7#b7 or 7#c7 ( section #ceec7;e77#b74 7#b7 ,prohibition ,! prohibition "u subsection 7f77#b7 %all n apply to-- 7,a7 necess>y 9 ! int]e/ ( national security2 7,b7 national security sy/ems2 or 7,c7 a procur$ int]net ( ?+s device describ$ 9 subsection 7f77#b77;,b7 t ! ,*ief ,in=mation ,(fic] ( an ag5cy det]m9es is-- 7i7 necess>y = rese>* purposes2 7ii7 necess>y 9 ! int]e/ ( national security2 or 7iii7 secur$ us+ alt]native & effective me?ods appropriate to ! function ( ! int]net ( ?+s device4 4 7b7 ,report on exemptions ,section #ceed7;c77#a7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act1 is fur!r am5d$-- 7#a7 9 subp>agraph 7,c71 by /rik+ & at ! end2 7#b7 9 subp>agraph 7,d71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7#c7 by add+ at ! end ! foll[+3 7,e7 ) respect to any exemption f ! requirem5ts ( subsection 7f77#c7 t is effective on ! date ( submission ( ! report1 includes ! numb] ( in=mation sy/ems t h receiv$ an exemption f ^? requirem5ts4 4 7c7 ,guidance = id5tity managem5t sy/ems us$ by ag5cies ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,(fice ( ,managem5t & ,budget1 9 consultation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 %all issue1 & r\t9ely update !reaft]1 guidance = ag5cies to implem5t id5tity managem5t sy/ems & a s+le sign-on tru/$ id5tity plat=m z requir$ "u section #ceed7;f77#a77;,d77i7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act1 :i* %all at a m9imum1 include ! foll[+3 7#a7 ,requirem5ts = ag5cies to r\t9ely c]tify t su* sy/ems are 9 compliance ) ?is guidance4 7#b7 ,requirem5ts = ag5cies to r\t9ely v]ify & c]tify t in=mation /or$ on or transit+ ?r\gh a comm]cially available product 7z def9$ 9 section #ajc ( title #da1 ,unit$ ,/ates ,code7 or comm]cial s]vice 7z def9$ 9 section #ajc;a ( title #da1 ,unit$ ,/ates ,code7 us$ to fulfil su* requirem5ts is appropriately secur$ 9 con=mity ) sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code4 7#c7 ,address national security conc]ns & requirem5ts to ensure ! protection ( s5sitive p]sonal records & biometric data ( ,unit$ ,/ates p]sons f malign =eign own]%ip1 control1 or influ5ce & fraud actors4 7#d7 ,requirem5ts or guidel9es to comply ) section #c ( ! #ba/ ,c5tury ,idea ,act 7#dd ,u4,s4,c4 #ceja note74 7#e7 ,requirem5ts to prev5t discrim9ation 9 violation ( title ,,vi ( ! ,civil ,rights ,act ( #aifd 7#db ,u4,s4,c4 #bjjj;d et seq474 7#f7 ,a description ( ! in=mation necess>y to be submitt$ "u ! exception describ$ 9 section #ceed7;f77#c77;,b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act4 7d7 ,,gao evaluation ( te*nical capability ( id5tity managem5t sy/ems & plat=ms ,n less frequ5tly ?an e #c ye>s = ! next #f ye>s1 ! ,comptroll] ,g5]al %all submit to ! appropriate congressional committees a report on :e!r ! s+le sign-on tru/$ id5tity sy/ems & plat=ms us$ by ag5cies or ! "o develop$ by ! ,g5]al ,s]vices ,adm9i/ration "u section #ceed7;f77,d77i7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act1 adh]e to ! in=mation security requirem5ts ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 guidance issu$ "u subsection 7c71 & relevant id5tity managem5t te*nical /&>ds promulgat$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology1 z appropriate1 includ+ section #ejd ( ! ,cyb]security ,enhancem5t ,act ( #bjad 7#ae ,u4,s4,c4 #gdfd74 7e7 ,duration ( c]tification effective date ,p>agraph 7#c7 ( section #ceed7;f7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 %all take effect on ! date t is #a ye> aft] ! date ( enactm5t ( ?is ,act4 7f7 ,f$]al ,cyb]security ,enhancem5t ,act ( #bjae update ,section #bbb7c77;,b7 ( ! ,f$]al ,cyb]security ,enhancem5t ,act ( #bjae 7#f ,u4,s4,c4 #aeba7c77;,b77 is am5d$ by ins]t+ & ! ,committee on ,ov]sight & ,acc\ntability be=e ( ! ,h\se ( ,repres5tatives4 #ab4 ,f$]al ,*ief ,in=mation ,security ,(fic] 7a7 ,am5dm5t ,*apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #cfag4 ,f$]al ,*ief ,in=mation ,security ,(fic] 7a7 ,e/abli%m5t ,!re is e/abli%$ a ,f$]al ,*ief ,in=mation ,security ,(fic]1 :o %all s]ve 9-- 7#a7 ! ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic] ( ! ,(fice ( ,managem5t & ,budget2 & 7#b7 ! ,(fice ( ! ,national ,cyb] ,director4 7b7 ,appo9tm5t ,! ,f$]al ,*ief ,in=mation ,security ,(fic] %all be appo9t$ by ! ,presid5t4 7c7 ,,omb duties ,! ,f$]al ,*ief ,in=mation ,security ,(fic] %all report to ! ,f$]al ,*ief ,in=mation ,(fic] & assi/ ! ,f$]al ,*ief ,in=mation ,(fic] 9 c>ry+ out-- 7#a7 e function "u ?is *apt]2 7#b7 e function assign$ to ! ,director "u title ,,ii ( ! ,e-,gov]nm5t ,act ( #bjjb 7#dd ,u4,s4,c4 #ceja note2 ,public ,law #ajg-cdg72 7#c7 o!r electronic gov]nm5t initiatives consi/5t ) o!r /atutes2 & 7#d7 o!r ,f$]al cyb]security initiatives det]m9$ by ! ,f$]al ,*ief ,in=mation ,(fic]4 7d7 ,additional duties ,! ,f$]al ,*ief ,in=mation ,security ,(fic] %all-- 7#a7 support ! ,f$]al ,*ief ,in=mation ,(fic] 9 ov]see+ & implem5t+ ,f$]al cyb]security "u ! ,e-,gov]nm5t ,act ( #bjjb 7,public ,law #ajg-cdg2 #aaf ,/at4 #bhii7 & o!r relevant /atutes 9 a mann] consi/5t ) law2 & 7#b7 p]=m e function assign$ to ! ,director "u sections #acba ?r\gh #acbh ( title #da1 ,unit$ ,/ates ,code4 7e7 ,coord9ation ) ,,oncd ,! ,f$]al ,*ief ,in=mation ,security ,(fic] %all support initiatives det]m9$ by ! ,f$]al ,*ief ,in=mation ,(fic] necess>y to coord9ate ) ! ,(fice ( ! ,national ,cyb] ,director4 4 7b7 ,national cyb] director duties ,section #ageb ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7#f ,u4,s4,c4 #aejj7 is am5d$-- 7#a7 by r$esignat+ subsection 7g7 z subsection 7h72 & 7#b7 by ins]t+ aft] subsection 7f7 ! foll[+3 7g7 ,s5ior ,f$]al ,cyb]security ,(fic] ,! ,f$]al ,*ief ,in=mation ,security ,(fic] appo9t$ by ! ,presid5t "u section #cfag ( title #dd1 ,unit$ ,/ates ,code1 %all be a s5ior (ficial )9 ! ,(fice & c>ry out duties applicable to ! protection ( in=mation te*nology 7z def9$ 9 section #aaaja ( title #dj1 ,unit$ ,/ates ,code71 includ+ initiatives det]m9$ by ! ,director necess>y to coord9ate ) ! ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic]4 4 7c7 ,treatm5t ( incumb5t ,! individual s]v+ z ! ,f$]al ,*ief ,in=mation ,security ,(fic] appo9t$ by ! ,presid5t z ( ! date ( enactm5t ( ?is ,act may s]ve z ! ,f$]al ,*ief ,in=mation ,security ,(fic] "u section #cfag ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 beg9n+ on ! date ( enactm5t ( ?is ,act1 )\t ne$ = a fur!r or additional appo9tm5t "u su* section4 7d7 ,cl]ical am5dm5t ,! table ( sections = *apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #cfag4 ,f$]al ,*ief ,in=mation ,security ,(fic]4 4 #ac4 ,r5am+ ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic] 7a7 ,def9itions 7#a7 ,9 g5]al ,section #cfja ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 by /rik+ p>agraph 7#a72 & 7,b7 by r$esignat+ p>agraphs 7#b7 ?r\gh 7#h7 z p>agraphs 7#a7 ?r\gh 7#g71 respectively4 7#b7 ,con=m+ am5dm5ts 7,a7 ,title #aj ,section #bbbb7;i77#f7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #cfja7d7 & ins]t+ section #cfja4 7,b7 ,national ,security ,act ( #aidg ,section #ejf;,d7k77#a7 ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cajj7k77#a77 is am5d$ by /rik+ section #cfja7d7 & ins]t+ section #cfja4 7b7 ,(fice ( electronic gov]nm5t ,section #cfjb ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 ! head+1 by /rik+ ,(fice ( ,electronic ,gov]nm5t & ins]t+ ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic]2 7#b7 9 subsection 7a71 by /rik+ ,(fice ( ,electronic ,gov]nm5t & ins]t+ ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic]2 7#c7 9 subsection 7b71 by /rik+ an ,adm9i/rator & ins]t+ a ,f$]al ,*ief ,in=mation ,(fic]2 7#d7 9 subsection 7c71 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ ,! ,adm9i/rator & ins]t+ ,! ,f$]al ,*ief ,in=mation ,(fic]2 7#e7 9 subsection 7d71 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ ,! ,adm9i/rator & ins]t+ ,! ,f$]al ,*ief ,in=mation ,(fic]2 7#f7 9 subsection 7e71 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ ,! ,adm9i/rator & ins]t+ ,! ,f$]al ,*ief ,in=mation ,(fic]2 7#g7 9 subsection 7f7-- 7,a7 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ ! ,adm9i/rator & ins]t+ ! ,f$]al ,*ief ,in=mation ,(fic]2 7,b7 9 p>agraph 7#af71 by /rik+ ! ,(fice ( ,electronic ,gov]nm5t & ins]t+ ! ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic]2 & 7,c7 9 p>agraph 7#ag71 by /rik+ ,e-,gov]nm5t & ins]t+ annual2 & 7#h7 9 subsection 7g71 by /rik+ ! ,(fice ( ,electronic ,gov]nm5t & ins]t+ ! ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic]4 7c7 ,*ief in=mation (fic]s c\ncil ,section #cfjc ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 subsection 7b77#b71 by /rik+ ,! ,adm9i/rator ( ! ,(fice ( ,electronic ,gov]nm5t & ins]t+ ,! ,f$]al ,*ief ,in=mation ,(fic]2 7#b7 9 subsection 7c77#a71 by /rik+ ,! ,adm9i/rator ( ! ,(fice ( ,electronic ,gov]nm5t & ins]t+ ,! ,f$]al ,*ief ,in=mation ,(fic]2 & 7#c7 9 subsection 7f7-- 7,a7 9 p>agraph 7#c71 by /rik+ ! ,adm9i/rator & ins]t+ ! ,f$]al ,*ief ,in=mation ,(fic]2 & 7,b7 9 p>agraph 7#e71 by /rik+ ! ,adm9i/rator & ins]t+ ! ,f$]al ,*ief ,in=mation ,(fic]4 7d7 ,e-,gov]nm5t fund ,section #cfjd ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 subsection 7a77#b71 by /rik+ ! ,adm9i/rator ( ! ,(fice ( ,electronic ,gov]nm5t & ins]t+ ! ,f$]al ,*ief ,in=mation ,(fic]2 7#b7 9 subsection 7b71 by /rik+ ,adm9i/rator ea* place x appe>s & ins]t+ ,f$]al ,*ief ,in=mation ,(fic]2 & 7#c7 9 subsection 7c71 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ ! ,adm9i/rator & ins]t+ ! ,f$]al ,*ief ,in=mation ,(fic]4 7e7 ,program to enc\rage innovative solutions to enhance electronic gov]nm5t s]vices & processes ,section #cfje ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 subsection 7a71 by /rik+ ,! ,adm9i/rator & ins]t+ ,! ,f$]al ,*ief ,in=mation ,(fic]2 7#b7 9 subsection 7b71 by /rik+ 1 ! ,adm9i/rator1 & ins]t+ 1 ! ,f$]al ,*ief ,in=mation ,(fic]12 & 7#c7 9 subsection 7c7-- 7,a7 9 p>agraph 7#a7-- 7i7 by /rik+ ,! ,adm9i/rator & ins]t+ ,! ,f$]al ,*ief ,in=mation ,(fic]2 & 7ii7 by /rik+ proposals submitt$ to ! ,adm9i/rator & ins]t+ proposals submitt$ to ! ,f$]al ,*ief ,in=mation ,(fic]2 7,b7 9 p>agraph 7#b77;,b71 by /rik+ ! ,adm9i/rator & ins]t+ ! ,f$]al ,*ief ,in=mation ,(fic]2 & 7,c7 9 p>agraph 7#d71 by /rik+ ! ,adm9i/rator & ins]t+ ! ,f$]al ,*ief ,in=mation ,(fic]4 7f7 ,e-,gov]nm5t report ,section #cfjf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 ! section head+ by /rik+ ,e-,gov]nm5t & ins]t+ ,annual2 7#b7 9 subsection 7a71 by /rik+ ,e-,gov]nm5t & ins]t+ annual2 & 7#c7 9 subsection 7b77#a71 by /rik+ #bjb7;f7 & ins]t+ #bjb7;g74 7g7 ,treatm5t ( incumb5t ,! individual s]v+ z ! ,adm9i/rator ( ! ,(fice ( ,electronic ,gov]nm5t "u section #cfjb ( title #dd1 ,unit$ ,/ates ,code1 z ( ! date ( enactm5t ( ?is ,act1 may cont9ue to s]ve z ! ,f$]al ,*ief ,in=mation ,(fic] comm5c+ z ( t date1 )\t ne$ = a fur!r or additional appo9tm5t "u su* section4 7h7 ,te*nical & con=m+ am5dm5ts ,! table ( sections = *apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 by /rik+ ! item relat+ to section #cfjb & ins]t+ ! foll[+3 #cfjb4 ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic]4 2 & 7#b7 9 ! item relat+ to section #cfjf1 by /rik+ ,e-,gov]nm5t & ins]t+ ,annual4 7i7 ,ref]5ces 7#a7 ,adm9i/rator ,any ref]5ce to ! ,adm9i/rator ( ! ,(fice ( ,electronic ,gov]nm5t 9 any law1 regulation1 map1 docum5t1 record1 or o!r pap] ( ! ,unit$ ,/ates %all be deem$ to be a ref]5ce to ! ,f$]al ,*ief ,in=mation ,(fic]4 7#b7 ,(fice ( ,electronic ,gov]nm5t ,any ref]5ce to ! ,(fice ( ,electronic ,gov]nm5t 9 any law1 regulation1 map1 docum5t1 record1 or o!r pap] ( ! ,unit$ ,/ates %all be deem$ to be a ref]5ce to ! ,(fice ( ! ,f$]al ,*ief ,in=mation ,(fic]4 #ad4 ,rules ( con/ruction 7a7 ,ag5cy actions ,no?+ 9 ?is ,act1 or an am5dm5t made by ?is ,act1 %all be con/ru$ to au?orize ! head ( an ag5cy to take an action t is n au?oriz$ by ?is ,act1 an am5dm5t made by ?is ,act1 or exi/+ law4 7b7 ,protection ( rights ,no?+ 9 ?is ,act1 or an am5dm5t made by ?is ,act1 %all be con/ru$ to p]mit ! violation ( ! rights ( any individual protect$ by ! ,con/itution ( ! ,unit$ ,/ates1 includ+ ?r\gh c5sor%ip ( spee* protect$ by ! ,con/itution ( ! ,unit$ ,/ates or unau?oriz$ surveillance4 7c7 ,protection ( privacy ,no?+ 9 ?is ,act1 or any am5dm5t made by ?is ,act1 %all be con/ru$ to-- 7#a7 imp+e on ! privacy rights ( individuals2 or 7#b7 all[ ! unau?oriz$ access1 %>+1 or use ( p]sonal data4 ,decemb] #ai1 #bjbd,report$ f ! ,committee on ,ov]sight & ,acc\ntability ) an amendment,december #ai1 #bjbd ,committees on ,sci5ce1 ,space1 & ,te*nology1 ,homel& ,security1 & ,arm$ ,s]vices dis*>g$2 committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union & ord]$ to be pr9t$